Cumulus Linux 3.7 Release Notes
Download all 3.7 release notes as .xls
3.7.16 Release Notes
Open Issues in 3.7.16
| Issue ID | Description | Affects | Fixed |
|---|---|---|---|
| 3410952 |
If MLAG is configured but disconnected from an MLAG peer for an extended period of time (days or more), there is a long delay (up to a minute per day) before traffic forwarding stabilizes after the MLAG peer connection re-establishes. | 3.7.0-4.3.1 | 4.3.2-4.4.5, 5.5.0-5.15.0 |
| 3376798 |
On Broadcom switches, Cumulus Linux does not create the hardware bridging domain for a traditional bridge with a VXLAN interface during switchd restart. The /var/log/switchd.log file includes the following exception logs shortly after switchd restarts:switchd[30158]: hal_bcm_l3.c:1617 find_egr_path_if_vxlan_overlay:vxlan overlay : nh PORT: port <#>, vlanMAC learning looks correct, but traffic does not flow as expected. |
3.7.0-4.3.1 | 4.3.2-4.4.5 |
| 3330705 |
When using TACACS+, a TACACS+ server name that returns more than one IP address, such as an IPv6 and IPv4 address, is counted many times against the limit of seven TACACS+ servers, which might cause some of the later listed servers to be ignored as over the limit. To work around this issue, you can set the prefer_ip_version configuration option (the default value is 4) to choose between an IPv4 or IPv6 address if both are present. |
3.7.0-5.3.1 | 5.4.0-5.15.0 |
| 3327477 |
If you use su to change to a user specified through TACACS+, the user becomes the local tacacs0 thru tacacs15 user instead of the named user to run sudo commands. As a result, the named user password might not match the local tacacs0 thru tacacs15 user password. |
3.7.0-3.7.16, 4.0.0-4.4.5, 5.0.0-5.15.0 | |
| 3260469 |
The cl-ecmpcalc command prints the following error when the egress interface is a bond or SVI:ecmpcalc: will query hardwareTraceback (most recent call last):File “/usr/cumulus/bin/cl-ecmpcalc”, line 986, inisTrunkMbr, port = ecmp.getHdPort(hd_cmd)File “/usr/cumulus/bin/cl-ecmpcalc”, line 618, in getHdPortport = int(str4)ValueError: invalid literal for int() with base 10: ‘0t |
3.7.16-4.3.1 | 4.3.2-4.4.5 |
| 3216921 |
RADIUS authenticated users with read-only access to NCLU commands (users in the users_with_show list) can run edit commands if a username for a non-local account is on the users_with_edit line of the /etc/netd.conf file. To work around this issue, make sure that all usernames on the users_with_edit line of the /etc/netd.conf file are configured local users for the system (real Linux users) |
3.7.0-3.7.16, 4.3.0-4.4.5 | |
| 3216759 |
With the ip-acl-heavy TCAM profile, the following message might appear after you install an ACL with NCLU or cl-acltool and the ACL might not work correctlyhal_flx_acl_util.c:378 ERR hal_flx_acl_resource_release resource region 0 size 7387 create failed: No More ResourcesTo work around this issue, change the TCAM profile to acl-heavy or ip-acl-heavy with ACL non-atomic mode. |
3.7.15-3.7.16, 4.3.0-4.4.5 | |
| 3209699 |
RADIUS authenticated users with read-only access to NCLU commands (users in the users_with_show list) can run edit commands if a username for a non-local account is on the users_with_edit line of the /etc/netd.conf file. To work around this issue, make sure that all usernames on the users_with_edit line of the /etc/netd.conf file are configured local users for the system (real Linux users) |
3.7.0-4.3.0, 4.4.0-5.2.1 | 4.3.1, 5.3.0-5.15.0 |
| 3129819 |
On the EdgeCore AS4610 switch, the clagd service loses communication after 198 days of uptime. |
3.7.15-3.7.16 | |
| 3128328 |
The clagd process uses 100 percent CPU and eventually crashes with an Unable to allocate memory error. |
3.7.16-4.3.0 | 4.3.1-4.4.5 |
| 3120423 |
When you configure an interface in FRR to send IPv6 RAs before you configure the interface in the /etc/network/interfaces file, the switch does not process IPv6 RAs. To work around this issue, remove the interface configuration in FRR and reapply it. |
3.7.15-4.3.0, 4.4.0-5.1.0 | 4.3.1, 5.2.0-5.15.0 |
| 3093966 |
On Broadcom switches, INPUT chain iptable rules filter IPv6 packets matching the rules. | 3.7.15-3.7.16, 4.3.0-4.4.5 | |
| 3073668 |
On the EdgeCore AS4610 switch, when you change the speed of any of the SFP+ ports, the other SFP+ ports flap. | 3.7.12-3.7.16, 4.3.0-4.4.5 | |
| 3072674 |
In an MLAG configuration, if you put a single connected interface into an admin down state, any dynamic MAC addresses on the peer link are flushed, then added back, which causes momentary traffic disruption. |
3.7.15-5.1.0 | 5.2.0-5.15.0 |
| 3072613 |
When you delete a bond interface with NCLU, BGP peer group configuration is removed. | 3.7.15-3.7.16, 4.3.0-4.4.5 | |
| 3066704 |
The hostapd service stops working if an 802.1X interface goes up and down many times over a long period of timeTo work around this issue, restart the hostapd service with the systemctl restart hostapd command. |
3.7.15-4.3.0 | 4.3.1-4.4.5 |
| 3053063 |
The update-ports.service fails because a blank space in the comment lines of the /etc/cumulus/ports.conf file causes parsing errors. To work around this issue, remove the blank spaces in the commented lines, then restart the update-ports and switchd services. |
3.7.15-4.3.0 | 4.3.1-4.4.5, 4.4.4-4.4.5 |
| 3020254 |
When ARP suppression is off, GARPs from neighmgrd for remote neighbors are sent over VXLAN. |
3.7.15-4.3.0, 4.4.0-4.4.3, 5.0.0-5.1.0 | 4.3.1, 4.4.4-4.4.5, 5.2.0-5.15.0 |
| 3017190 |
When you power cycle the switch, multiple interfaces came up in a PoE disabled state To work around this issue, run the sudo poectl -a | grep disabled command to find ports with disabled POE. Run the sudo poectl -e swp1-swp48 command to enable POE on affected ports. |
3.7.10-3.7.16 | |
| 3015881 |
Traffic flows fail because the remote VTEP IP address is missing in the layer 3 neighbor table in hardware on the switch. This happens when there is a neighbor entry for the same /32 that we have also received a type-5 route for. When the route is learned after the neighbor entry there is a timing condition that can be hit that will cause the neighbor entry to get removed from hardware when the route is installed in hardware This condition has been seen when customers re-use the VTEP IP on an interface inside of a vrf. The neigh entry for the TEP IP is installed when a symmetric route is learned via that VTEP. The Type-5 route for the TEP IP is learned in the VRF if the customer has redistributed it or advertised it within BGP in the VRF. |
3.7.15-3.7.16 | |
| 2993719 |
After you delete the last vxlan-remoteip configuration line from the /etc/network/interfaces file and run the ifreload -a command, the corresponding BUM flood entry is not removed. This is issue is impacting all Cumulus Linux releases. The following attribute: vxlan-purge-remotes yes is intended to fix the issue (this attribute has been available since CL2). It was decided to change ifupdown2’s default behavior to automatically purge BUM entries added by ifup/ifreload. |
3.7.15-5.0.1 | 5.1.0-5.15.0, 5.2.0-5.15.0 |
| 2991514 |
Cumulus Linux can take a long time (100 seconds) to sync a large number of VNIs on a bridge. | 3.7.15-4.3.0 | 4.3.1-4.4.5 |
| 2972538 |
With RADIUS enabled for user shell authentication, there might be a delay in local user authentication for non cumulus user accounts. | 3.7.15-3.7.16 | |
| 2965759 |
On the EdgeCore AS4610-54T switch, the fan speed reports a minimum threshold in the logs. | 3.7.15-3.7.16 | |
| 2959067 |
ECMP produces errors indicating No More Resources and switchd crashes even when ECMP utilization is low. |
3.7.14.2-4.2.1 | 4.3.0-4.4.5 |
| 2951110 |
The net show time ntp servers command does not show any output with the management VRF. |
3.7.15-3.7.16, 4.1.1-4.4.5, 5.0.0-5.15.0 | |
| 2947679 |
If the clagd service stops during initDelay, the peerlink flag does not clear from any VNIs that become dual connected during this time. switchd uses the peerlink flag to program MLAG loop prevention. As a result of the overlapping stale flags, traffic destined for the VXLAN might drop. |
3.7.15-3.7.16 | |
| 2934939 |
When you configure BGP aggregate-address summary-only and any component route within the summary updates, all component routes within the summary update in the RIB on the device advertising the summary. This condition might result in increased CPU usageTo workaround this issue, remove the aggregate-address summary-only configuration, add a static route to Null0 for the prefix, and configure an outbound route map to restrict anything more specific than the desired prefix from being advertised. For example: Before:address-family ipv4 unicastAfter: ip route 10.10.0.0/16 Null0This example assumes no other static routes are present. Otherwise, you might need to configure additional route maps to limit the static routes being redistributed. |
3.7.12-3.7.16 | |
| 2910017 |
SNMP reports the same ifType of ethernetCsmacd(6) for loopback interfaces. |
3.7.15-4.4.2, 5.0.0-5.0.1 | 4.4.3-4.4.5, 5.1.0-5.15.0 |
| 2899413 |
Broadcom switches return a table full error when creating VXLAN gports, which causes switchd to crash. |
3.7.15-4.3.0 | 4.3.1-4.4.5 |
| 2866084 |
When you reboot a VTEP, MAC address entries might become out of sync between the kernel FDB table and the EVPN MAC VNI table on remote VTEPs. The impacted MAC entries are installed against the rebooted VTEP IP address in the kernel FDB and the correct VTEP IP is present in the EVPN MAC VNI table. To work around this issue, clear all corrupted MAC address entries in the kernel FDB with the bridge fdb del dev command, then add “vxlan-learning”: “off” in the /etc/network/ifupdown2/policy.d/vxlan.json file:$ cat /etc/network/ifupdown2/policy.d/vxlan.jsonReboot the affected switches. |
3.7.12-4.3.0 | 4.3.1-4.4.5 |
| 2866061 |
On the Maverick S4148T switch with MLAG, Cumulus Linux drops LACP, ARP, LLDP and BGP traffic. | 3.7.12-3.7.16 | |
| 2859177 |
The cl-route-check –layer3 command fails with a memory error. For example:cumulus@switch:~$ sudo cl-route-check –layer3Traceback (most recent call last): |
3.7.15-3.7.16 | |
| 2855908 |
Traffic failover in a multicast topology with redundancy has the mroute stuck in a prune state and PIM join messages continue to send To work around this issue, run the vtysh clear ip mroute command. |
3.7.15-4.3.0, 4.4.0-5.0.1 | 4.3.1, 5.1.0-5.15.0 |
| 2853536 |
MLAG between Cumulus Linux and Arista devices might result in some links being suspended by the Arista devices with the error LACP partner validation failedThis happens when you use the same LACP port ID for more than one bond member on the Cumulus Linux switch To work around this issue, run the net add bond command on the bond on the Cumulus Linux switch. For proper operation, you need to make the equivalent change on the device on the other side of the link. |
3.7.15-3.7.16 | |
| 2827336 |
After bringing up a bridge port, there is a multi second delay before the bridge port is able to learn any MAC addresses or neighbors, which causes a forwarding delay (about six seconds with 300 or more VLANs). | 3.7.15-3.7.16 | |
| 2798979 |
Configuring a route map to filter VNIs will cause type-3 routes not to be advertised even for L2VNIs permitted through the route map | 3.7.15-3.7.16 | |
| 2792750 |
If you change the clagd-vxlan-anycast-ip setting on both MLAG peers at the same time, both peers use their unique VTEP address indefinitely. |
3.7.15-4.3.0, 4.4.0-4.4.5 | 4.3.1 |
| 2754791 |
Remote MAC addreses in zebra are out of sync with bgpd. The zebra MAC addresses point to an incorrect (old) VTEP IP address and the sequence number is one higher than in BGP. |
3.7.14.2-3.7.16, 4.3.0-4.4.5 | |
| 2743186 |
When you use MD5 passwords and you configure a non-default VRF before the default VRF in the /etc/frr/frr.conf file, numbered BGP sessions do not establish. |
3.7.15-5.1.0 | 5.2.0-5.15.0 |
| 2730225 |
When withdrawal and advertisement processing occurs in short succession, type-2 routes with an IP are not imported into layer 2 VNIs. | 3.7.12-4.3.0 | 4.3.1-4.4.5, 4.4.2-4.4.5 |
| 2716822 |
The /etc/cumulus/ports.conf file on the Dell Z9264F-ON switch does not show that Cumulus Linux does not support the 2x10G SFP+ ports. |
3.7.15-4.3.0 | 4.3.1-4.4.5 |
| 2713888 |
With the ip-acl-heavy TCAM profile, the following message might appear after you install an ACL with NCLU or cl-acltool and the ACL might not work correctlyhal_flx_acl_util.c:378 ERR hal_flx_acl_resource_release resource region 0 size 7387 create failed: No More ResourcesTo work around this issue, change the TCAM profile to acl-heavy or ip-acl-heavy with ACL non-atomic mode. |
3.7.15-5.0.1 | 5.1.0-5.15.0 |
| 2687332 |
When you configure BGP aggregate-address summary-only and any component route within the summary updates, all component routes within the summary update in the RIB on the device advertising the summary. This condition might result in increased CPU usageTo workaround this issue, remove the aggregate-address summary-only configuration, add a static route to Null0 for the prefix, and configure an outbound route map to restrict anything more specific than the desired prefix from being advertised. For example: Before:address-family ipv4 unicastAfter: ip route 10.10.0.0/16 Null0This example assumes no other static routes are present. Otherwise, you might need to configure additional route maps to limit the static routes being redistributed. |
3.7.12-4.2.1 | 4.3.0-4.4.5 |
| 2684452 |
When a VTEP is rebooted, MAC address entries might become out of sync between the kernel fdb table and the EVPN MAC VNI table on remote VTEPs. The impacted MAC entries will be installed against the rebooted VTEP IP in the kernel fdb and the correct VTEP IP will be present in the EVPN MAC VNI table You can work around this issue with the following steps:1. Clear all corrupted mac entries in the kernel FDB with the bridge fdb del dev command2. Add “vxlan-learning”: “off” under /etc/network/ifupdown2/policy.d/vxlan.json$ cat /etc/network/ifupdown2/policy.d/vxlan.json3. Reboot the affected switch(es) |
3.7.12-3.7.16 | |
| 2669438 |
Editing the /etc/frr/frr.conf file to add a new sequence at the beginning of an existing large prefix list changes the subsequent sequence numbers of the next entries in the list and FRR reload might fail with the error message frr.service reload operation timed out. Stopping. To work around this issue, instead of adding the new prefix using an existing sequence number and pushing other sequences forward, use a sequence number that is free; for example, instead of of using 5 -> 10 -> 15, use 5 -> 7 -> 10. |
3.7.11-3.7.16 | |
| 2653400 |
When 802.1x MAB and a parking VLAN are configured on an interface, hostapd might install a static fdb entry if the interface is down. To work around this issue, delete 802.1x from the interface with the net del interface command, then add back the 802.1x configuration. |
3.7.10-3.7.16 | |
| 2648658 |
If you try to use more than one percent of max-ecmp-nexthops, you get an error indicating a failure. |
3.7.15-4.3.3 | 4.4.0-4.4.5 |
| 2638137 |
When you delete a static route using NCLU, the configuration is not deleted from the running configuration or from the /etc/frr/frr.conf file. |
3.7.13-3.7.16 | |
| 2633245 |
On the Dell N3048EP-ON switch, the SPF+ ports remain down after a power cycle. | 3.7.10-3.7.16 | |
| 2607965 |
On the EdgeCore AS7726 switch, when you run the NCLU net show system command, you see the error Command not found. |
3.7.14.2-3.7.16 | |
| 2562347 |
When you bring VXLAN interfaces up and down physically or administratively, the MTU for the SVIs changes to 1550 (the default value). | 3.7.14.2-3.7.16 | |
| 2556037 |
After you add an interface to the bridge, an OSPF session flap might occur |
3.7.9-4.2.0 | 4.2.1-4.4.5 |
| 2555908 |
If the you add the MLAG backup IP address to the MLAG peer in the secondary role while the peer link is down, the LACP sys-mac does not use the MLAG system MAC address (clagd-sys-mac) when the peer link comes back up To work around this issue, wait until the peer link is up to add the MLAG backup IP address. To recover from this condition, restart clagd with the sudo systemctl restart clagd command. |
3.7.12-4.0.1 | 4.1.0-4.4.5 |
| 2555528 |
In an EVPN Active/Active configuration, when one of the peers reboots and begins to refresh IP neighbor entries shared by the MLAG peer, some of these ARP messages might be dropped by the MLAG peer’s ARP policer. To work around this issue, increase the burst value of the ARP policers to 200 or higher. |
3.7.14-4.2.1 | 4.3.0-4.4.5 |
| 2555175 |
Control plane traffic (such as BGP peering from leaf to spine) goes down on the leaf due to the peer Hold Down timer expiration following prolonged link flaps on down links when VXLAN enabled VLANs are carried on the flapping link. Be sure to correct layer 1 issues, configuration issues, or misbehaving link partners that are causing the link flaps. | 3.7.15-4.3.1 | 4.3.2-4.4.5 |
| 2554785 |
After you reboot a Broadcom switch, switchd might fail to restart and you see logs in switchd.log similar to the following:Nov 12 12:20:05.063876 leaf01 switchd[9867]:Nov 12 12:20:05.064310 leaf01 switchd[9867]: hal_bcm_console.c:294 0:system_init:Nov 12 12:20:05.064428 leaf01 switchd[9867]: hal_bcm_console.c:294 system_init: Misc init failed: Operation timed outNov 12 12:20:05.064464 leaf01 switchd[9867]:Nov 12 12:20:05.091995 leaf01 switchd[9867]: hal_bcm_console.c:294 LED: Loading 256 bytes into LED program memoryNov 12 12:20:05.092029 leaf01 switchd[9867]:Nov 12 12:20:05.099547 leaf01 switchd[9867]: hal_bcm_console.c:294 PORT: Error: bcm ports not initializedNov 12 12:20:05.099579 leaf01 switchd[9867]:Nov 12 12:20:05.099646 leaf01 switchd[9867]: hal_bcm_console.c:294 Error: file /var/lib/cumulus/rc.datapath_0: line 81 (error code -1): script terminatedNov 12 12:20:05.099667 leaf01 switchd[9867]:Nov 12 12:20:05.099775 leaf01 switchd[9867]: hal_bcm_console.c:294 Error: file /etc/bcm.d/rc.soc: line 70 (error code -1): script terminatedNov 12 12:20:05.099798 leaf01 switchd[9867]:Nov 12 12:20:05.099871 leaf01 switchd[9867]: hal_bcm_console.c:294 ERROR loading rc script on unit 0Nov 12 12:20:05.099892 leaf01 switchd[9867]:Nov 12 12:20:05.099943 leaf01 switchd[9867]: hal_bcm_console.c:299 CRIT loading of rc script failed, aborting!To work around this issue, configure Cumulus Linux to boot with the ntel_iommu=off kernel command option:1. Open the /etc/default/grub file with a text editor2. Edit the GRUB_CMDLINE_LINUX variable by adding the string intel_iommu=off at the end. For example: GRUB_CMDLINE_LINUX=“cl_platform=cel_e1031 console=ttyS1,115200n8 intel_iommu=off"3. Run the update-grub command4. Reboot the switch. |
3.7.11-4.2.1 | 4.3.0-4.4.5 |
| 2554709 |
The IP address specified in the ip pim use-source command configured on the loopback interface should be inherited by unnumbered interfaces during their Primary IP address selection process. If ip pim use-source is configured on the loopback after an unnumbered interface has already selected their Primary IP address, the unnumbered interface does not update its Primary IP address to be the new use-source value until after there is a netlink update for that interface.To work around this issue, configure ip pim use-source on each unnumbered interface directly or ensure ip pim use-source is applied to the loopback before other unnumbered interfaces are enabled for PIM. |
3.7.13-3.7.16, 4.2.1-4.4.5 | |
| 2554588 |
If you try to reconfigure a DHCP server after you delete the switch configuration with the net del all command, the dhcpd service fails because a duplicate process is runningTo work around this issue, edit the /usr/lib/python2.7/dist-packages/nclu/plugins/dhcp.py file to change:DHCPD_PID="-pf {0}” to:DHCPD_PID="-pf {1}" |
3.7.13-4.2.1 | 4.3.0-4.4.5 |
| 2554369 |
Certain Dell S4048-ON switches show an incorrect vendor name and hang when you issue the reboot command. |
3.7.12-4.2.1 | 4.3.0-4.4.5 |
| 2554329 |
On the Dell N3248PXE switch, fixed RJ45 interfaces with PoE neighbors can end up in Paused mode after a switchd restart, which blocks traffic on that interface. |
3.7.12-3.7.16 | |
| 2553887 |
When using TACACS+ configured with a DEFAULT user providing privilege level lower than 16, TACACS+ configured users with privilege level 16 access might not be able to run privilege level 16 NCLU commands, such as net add and net del and see an error similar to the following:
To work around this issue, remove the DEFAULT user from the TACACS+ server. |
3.7.7-3.7.16, 4.0.0-4.4.5 | |
| 2553677 |
When you configure an SNMPv3 user with the net-snmp-config configuration command from the libsnmp-dev package, you get an error message similar to the one below:
To work around this issue, use the NCLU command to configure SNMPv3 user parameters; for example:
Alternatively, directly edit the /etc/snmp/snmpd.conf file as described in the documentation. |
3.7.13-3.7.16, 4.0.0-4.4.5 | |
| 2553219 |
You cannot configure SNMPv3 trap-destinations in non-default VRFs with an authentication username that contains fewer than eight characters. | 3.7.12-4.2.1 | 4.3.0-4.4.5 |
| 2553116 |
When you manually set the link speed or duplex mode with ethtool to an unsupported value, then run a TDR check against the interface, you encounter a switchd service heartbeat failure.To work around this issue, reboot the switch to clear the condition. Avoid setting the interface speed or duplex mode directly with ethtool. |
3.7.12-3.7.16, 4.0.0-4.4.5 | |
| 2553050 |
SNMP status might incorrectly reflect that a BGP neighbor is down due to an issue between bgpd and SNMP AgentX when the IP-FORWARD-MIB is also polled.To work around this issue, avoid polling IP-FORWARD-MIB objects. |
3.7.12-3.7.16 | |
| 2553015 |
If a neighbour contains a special character in PortID for LLDP, the net show interface command does not display the LLDP information or the command might fail. |
3.7.10-3.7.16, 4.2.0-4.4.5 | |
| 2552939 |
RX_DRP on a bond interface increases without any data traffic while the slave port does not increase. | 3.7.12-4.2.1 | 4.3.0-4.4.5 |
| 2552869 |
On the Dell N3048EP switch, the module information from SFP ports is not displayed in the l1-show command.To work around this issue, use the ethtool -m command. |
3.7.13-4.2.1 | 4.3.0-4.4.5 |
| 2552742 |
On the Mellanox SN2410 switch, you see switchd core and GBIN_MALLOC errors.To work around this issue, restart switchd. |
3.7.12-4.2.1 | 4.3.0-4.4.5 |
| 2552739 |
Counters for IPROUTER rules do not increase when traffic is forwarded to the CPU because there is no IP neighbor. | 3.7.2-3.7.16 | |
| 2552294 |
NCLU restarts FRR when removing a BGP VRF IPv4 aggregate-address command. |
3.7.12-3.7.16, 4.0.0-4.4.5 | |
| 2551911 |
ifupdown2 does not account for link status or link down configuration when running dhclient. For example, ifupdown2 ignores link-down yes during ifup/ifreload and runs the DHCP module if inet dhcp is configured on the interface. ifupdown2 also runs the DHCP module even when the physical link configured for DHCP is down. |
3.7.12-4.2.0 | 4.2.1-4.4.5 |
| 2551578 |
When you configure a bridge in the /etc/network/interfaces file, then try to reconfigure the bridge to be a VRF interface with the same name, ifreload/ifup commands fail with an invalid table id or unable to get vrf table id error. |
3.7.12-3.7.16, 4.0.0-4.4.5 | |
| 2551565 |
If you toggle VRRP priority values between VRRP routers, then restart switchd, a few IPv6 VRRP instances might not converge. As a result, both the VRRP routers act as master routers for the impacted IPv6 VRRP instances. IPv4 VRRP instances are not affectedTo work around this issue, remove, then add back the VRRP configuration with NCLU or vtysh commands. |
3.7.13-3.7.16, 4.2.0-4.4.5 | |
| 2551305 |
The net show configuration command provides the wrong net add command for ACL under the VLAN interface. |
3.7.12-3.7.16, 4.1.0-4.4.5 | |
| 2551288 |
When you remove BFD configuration by editing the /etc/frr/frr.conf file and restarting FRR, you see a traceback.To work around this issue, either use NCLU or vtysh commands to remove the BFD configuration, or restart FRR with the new /etc/frr/frr.conf file. |
3.7.7-3.7.16 | 4.0.0-4.4.5 |
| 2550974 |
On the Dell S3000 switch, after installing the Cumulus Linux 4.1.1 disk image without a license, the switch sends a link beat if a remote host port is configured. | 3.7.11-3.7.16, 4.1.1-4.4.5 | |
| 2550942 |
NCLU tab completion for net show displays the text add help text instead of system Information for the system option. |
3.7.11-4.2.0 | 4.2.1-4.4.5 |
| 2550796 |
On a Broadcom switch with the Trident2+ ASIC, ACL rules for VLANs are not applied after a reboot and the counters remain at zero. To work around this issue, either do not set acl.non_atomic_update_mode = TRUE in the /etc/cumulus/switchd.conf file or run the cl-acltool -i command after the reboot to install the ACLs. |
3.7.12-4.2.1 | 4.3.0-4.4.5 |
| 2550793 |
The NCLU net show bridge spanning-tree command displays the aging timer incorrectly. |
3.7.12-3.7.16, 4.0.0-4.4.5 | |
| 2550478 |
VXLAN interface as in-interface or out-interface in an ACL is not supported in Spectrum-based switches. | 3.7.7-4.2.0 | 4.2.1-4.4.5, 4.3.0-4.4.5 |
| 2550444 |
Tab completion for the net show rollback description command returns information about a snapshot instead of context help.To work around this issue, run the net show commit history command to find descriptions instead of the net show rollback description command. |
3.7.12-3.7.16, 4.0.0-4.4.5 | |
| 2550443 |
The net show rollback description command returns an error even if the string matches a commit description.To work around this issue, look for your string in the output of the net show commit history command (or grep for it there) instead. |
3.7.12-3.7.16, 4.0.0-4.4.5 | |
| 2550276 |
In LLDP, the snmp subagent loses all subsequent lldpRemSysName (1.0.8802.1.1.2.1.4.1.1.9) entries after an entry with a missing SysName is added.All the information from lldpctl is correct. Only the entries after the entry that is missing a SysName in lldpRemSysName disappear from the snmp subagent. |
3.7.12-4.2.1 | 4.3.0-4.4.5 |
| 2550243 |
When you use nginx and restserver in management VRF to provide a REST API for the switch, nginx starts but restserver fails to start.To work around this issue, comment out the Requires= line in the /lib/systemd/system/restserver.service. For example:
|
3.7.12-3.7.16, 4.0.0-4.4.5 | |
| 2550056 |
The ACCTON-DIAG option under the Cumulus Linux GRUB menu does not work. When you select this option, you see the following error:
|
3.7.12-3.7.16, 4.1.1-4.4.5 | |
| 2549925 |
When you run an Ansible script to replace the /etc/network/interfaces file, then run the ifreload -a command, you see errors similar to the following:
To work around this issue, run the ifreload -a command a second time. |
3.7.12-3.7.16, 4.0.0-4.4.5 | |
| 2549872 |
If you have an SVI with multiple VRR IP addresses and try to delete one of the VRR configurations, net commit or ifreload -a returns an error. |
3.7.12-3.7.16, 4.1.1-4.4.5 | |
| 2549838 |
In vtysh, if you configure, then remove a layer 3 VNI for a VRF, the VNI is removed from zebra even if the VNI interface still exists in the kernel. If you configure a layer 2 VNI as a layer 3 VNI by mistake, removing the layer 3 VNI binding removes it from zebra but EVPN-learned MACs and neighbors are not installed into the kernel. To work around this issue, delete, then re-add the missing VNI. For example:
If you flap the link with the ip link set vni10100 down; ip link set vni10100 up commands, zebra does not re-add the VNI. |
3.7.12-4.2.1 | 4.3.0-4.4.5 |
| 2549782 |
The JSON format output of the net show bgp l2vpn evpn summary command shows the incorrect neighbour state. |
3.7.12-3.7.16, 4.0.0-4.4.5 | |
| 2549731 |
When you create SPAN or ERSPAN rules in ebtables, the action fails to install if it is not in lowercase. Make sure that the SPAN or ERSPAN action is all lowercase; for example:
|
3.7.12-3.7.16, 4.1.1-4.4.5 | |
| 2549472 |
On switches with the Trident3 ASIC, PFC is not working as expected. If you set the PFC for only one CoS, pause frames are sent for all CoS traffic. | 3.7.11-4.1.1 | 4.2.0-4.4.5 |
| 2549371 |
When Optimized Multicast Flooding (OMF) is enabled with the bridge.optimized_mcast_flood = TRUE setting in the /etc/cumulus/switchd.conf file, the switch continues to flood IPv6 multicast traffic to all slave ports when there is no MLD join receive. |
3.7.11-4.3.3 | 4.4.0-4.4.5 |
| 2548962 |
With FRR or OSPF, you might see an inconsistent link-state advertisement. For example, when you configure the OSPF default originate route as metric-type 1 with a specific metric, Cumulus Linux shows the default originate route as an external metric-type 2 route with the default metric in the database. This issue typically occurs when both IPv4 and IPv6 default routes exist in the routing table. | 3.7.12-4.1.1 | 4.2.0-4.4.5 |
| 2548930 |
On Mellanox Spectrum switches that contain an OSPF IP unnumbered neighborship with a high scale of prefixes being learned, a link flap might cause the neighbor entry to not be programmed in hardware. | 3.7.11-4.2.1 | 4.3.0-4.4.5 |
| 2548746 |
On the Broadcom switch with the Trident3 ASIC, packet priority remark values assigned from each internal CoS value continue to work with default values; if you change the internal CoS value, the change does not take effect. | 3.7.11-4.1.1 | 4.2.0-4.4.5 |
| 2548657 |
When you upgrade Cumulus Linux on the EdgeCore AS7726-32X or AS7326-56X switch, you might see firmware errors similar to the following:
You can safely ignore these error messages. |
3.7.12-3.7.16, 4.0.0-4.4.5 | |
| 2548490 |
A change in a route map prefix list that should remove a route might not be reflected in the ospf6 database or in peers, and the route might not be deleted. To work around this issue, reenter the redistribute <connected|static> route-map statement in the configuration. |
3.7.11-4.1.1 | 4.2.0-4.4.5 |
| 2548485 |
If you configure the aggregate-address summary-only option before injecting a component of the same aggregate into the BGP table with the network or redistribute command, when you remove the aggregate-address configuration, the component stays suppressed; it is not advertised to peers. For example:Existing configuration:router bgp 1If you add network 50.0.0.1/32, you see the following (expected) BGP table entries:Status codes: s suppressed, d damped, h history, * valid, > best, = multipath,Removing aggregate-address 50.0.0.0/8 summary-only at this point results in the following (unexpected) BGP table entry:Status codes: s suppressed, d damped, h history, * valid, > best, = multipath,To work around this issue, remove, then re-add the component prefix routes. |
3.7.12-4.2.1 | 4.3.0-4.4.5 |
| 2548243 |
On switches with the Trident2+ ASIC, adding SPAN rules disables PBR rules. | 3.7.3-3.7.16, 4.0.0-4.4.5 | |
| 2548155 |
The net show bgp neighbor swpX json command shows negative output for the bgpTimerUpMsec timer. |
3.7.10-3.7.16 | 4.0.0-4.4.5 |
| 2548117 |
In OVSDB traditional bridge mode, adding or removing a VLAN binding causes a traffic forwarding outage for around 20 seconds or more on adjacent VLAN bindings. Cumulus Linux does not support traditional bridge mode with VMware NSX. | 3.7.12-3.7.16, 4.0.0-4.4.5 | |
| 2548024 |
On the Dell Z9100 switch, 100G-SR4 modules might not link up reliably in certain ports. swp1, 2, 3, 9, 10, 23, 24, 30, 31, and 32 might be affected To work around this issue, move 100G SR4 modules to one of the ports not affected by this issue. |
3.7.11-4.1.1 | 4.2.0-4.4.5 |
| 2547942 |
On the Lenovo NE0152T switch, one power supply (PSU2) always show as ABSENT in smonctl. | 3.7.11-4.0.1 | 4.1.0-4.4.5 |
| 2547839 |
When you try to configure link-down on a parent interface of a subinterface configured in a VRF, you encounter an error. |
3.7.11-4.1.1 | 4.2.0-4.4.5 |
| 2547782 |
If a LLDP neighbor advertises a PortDescr that contains commas, ptmctl -d splits the string on the commas and misplaces its components in other columns. |
3.7.11-3.7.16, 4.0.0-4.4.5 | |
| 2547706 |
When you configure ganged ports in the ports.conf file, the change does not take effect after you restart switchd. To work around this issue, reboot the switch. |
3.7.11-3.7.16, 4.0.0-4.4.5 | |
| 2547659 |
On the EdgeCore AS7326-56X switch, the default fan speed, which is defined in the thermal specification, results in excessive fan noise. | 3.7.11-4.0.1 | 4.1.0-4.4.5 |
| 2547573 |
On Tomahawk switches, when the vxlan_tnl_arp_punt_disable option is set to FALSE, ARP packets are not forwarded to the CPU. |
3.7.9-3.7.16 | |
| 2547443 |
On the Dell N3248PXE-ON switch, 25G SFP ports do not work in 10G mode. | 3.7.11-4.0.1 | 4.1.0-4.4.5 |
| 2547381 |
The hsflowd service sends an undefined header protocol 0 in the sampled flow sample to the collector, which is not recognized by the sFlow tool. You see errors similar to the following:
|
3.7.11-3.7.16 | 4.0.0-4.4.5 |
| 2547349 |
When you change an interface IP address, then change it back, static routes are misprogrammed One of the following actions recovers the routes:- Bounce both layer 3 interfaces- Remove or add static routes in FRR- Restart FRR |
3.7.11-3.7.16 | 4.0.0-4.4.5 |
| 2547123 |
On the Broadcom switch with the Trident3 ASC, packet priority remark values assigned from each internal CoS value continue to work with default values; if you change the internal CoS value, the change does not take effect. | 3.7.11-4.1.1 | 4.2.0-4.4.5 |
| 2547120 |
After you hot swap a PSU, the decode-syseeprom -t psuX command shows the old PSU information (such as the serial number), until you run the decode-syseeprom –init command. |
3.7.11-3.7.16, 4.0.0-4.4.5 | |
| 2547100 |
On switches with the Trident3 ASIC, PFC is not working as expected. If you set the PFC for only one CoS, pause frames are sent for all CoS traffic. | 3.7.11-4.1.1 | 4.2.0-4.4.5 |
| 2547068 |
Hardware platforms using the Intel D-1500 CPU series might reboot unexpectedly To work around this issue, contact your hardware vendor to inquire if a new version of BIOS with a microcode fix is available or manually disable CPU C-states in the kernel as outlined below To permanently disable C-states using a kernel boot parameter:1. Edit /etc/default/grub to add the argument processor.max_cstate=0 to the variable GRUB_CMDLINE_LINUX. For example, if /etc/default/grub file contains the line GRUB_CMDLINE_LINUX=“cl_platform=accton_as7726_32x console=tty0 console=ttyS0,115200n8 intel_iommu=off pcie_aspm=off”, change it to GRUB_CMDLINE_LINUX=“cl_platform=accton_as7726_32x console=tty0 console=ttyS0,115200n8 intel_iommu=off pcie_aspm=off processor.max_cstate=0”2. Run sudo update-grub3. Reboot the system with sudo rebootTo disable cstates in realtime on the current system, which does not persist through a reboot:1. Confirm that the libpci3 package is installed. Run dpkg-query -l libpci3 and confirm the following line is displayed:ii libpci3:amd64 1:3.2.1-3 amd64 Linux PCI Utilities (shared library)The first field above should read ii. If not, install the libpci3 package by running sudo apt upgrade;sudo apt install libpci32. Disable C-states by running the command ./cpupower idle-set -d 2C-states are disabled by default in Cumulus Linux 4.3.0 and later. |
3.7.9-4.2.1 | 4.3.0-4.4.5 |
| 2546991 |
The FRR service does not provide a way for automation to know if the configuration applied properly. To work around this issue, execute the vtysh -f command in the automation file before starting the FRR service to validate the functional configuration and return an error code. |
3.7.11-3.7.16, 4.0.0-4.4.5 | |
| 2546895 |
If you have configured a higher number of ports and VLANs (ports x VLANs) or the switch is a lower-powered (CPU) platform, the switchd service might fail to send a systemd keepalive within the watchdog timeout value (2 minutes by default) and you see an error similar to the following:bq. systemd[1]: switchd.service watchdog timeout (limit 2min)!To workaround this issue, either reduce the number of configured interfaces and, or VLANs, or increase the systemd timeout for switchd.serviceTo increase the systemd timeout:1.Edit the /etc/systemd/system/switchd.service.d/override.conf file and increase the WatchdogSec parameter2.Restart the switchd service with the sudo systemctl restart switchd.service commandsystemd attempts to restart the switchd service automatically (after the watchdog timeout). If the restart fails multiple times in a short time period, run the sudo systemctl reset-failed command followed by the sudo systemctl restart switchd command. |
3.7.11-3.7.16, 4.0.0-4.4.5 | |
| 2546450 |
On the EdgeCore AS7326-56X switch, you might see the RPM of certain fans run over the maximum threshold. | 3.7.11-3.7.16 | |
| 2546385 |
SNMP ifLastChange reports link transitions when there are none. | 3.7.6-3.7.16 | |
| 2546225 |
When you execute the following command on the Delta AG6248C switch, the switch reboots and then comes right back into Cumulus Linux without installing the new image. The install image is still in /var/lib/cumulus/installer, which causes issues with cl-support.
To work around this issue, use the onie-select command to access ONIE, and then use the nos-install command in ONIE to install a new binary image. |
3.7.11-3.7.16, 4.0.0-4.4.5 | |
| 2546203 |
When using QinQ with a traditional bridge, if you enable the LLDP dot1 TLV option, you see the following suboptimal behavior: * Both the inner and outer VLAN information is sent as part of VLAN TLVs in the LLDP packet. * If the outer VLAN ID is the same as the inner VLAN ID, only one VLAN TLV is sent with that VLAN ID in the LLDP packet. |
3.7.11-3.7.16 | |
| 2546131 |
On the Delta AG-6248C PoE switch, when you run the apt upgrade command, the upgrade does not work. Cumulus Linux uses uboot directly instead of grub to boot the kernel. Uboot needs a special header to boot the kernel, which is not present. Without this header, when you use the apt upgrade command to upgrade Linux packages, uboot is unable to boot up the kernel. To work around this issue, upgrade Cumulus Linux by installing the Cumulus Linux image. Run the onie-select command to go into ONIE, and then use the nos-install command in ONIE to install a new image.This workaround only works when an out-of-band network is present. |
3.7.11-3.7.16, 4.0.0-4.4.5 | |
| 2546010 |
When hal.bcm.per_vlan_router_mac_lookup is set to TRUE in the /etc/cumulus/switchd.conf file, inter-VLAN traffic is forwarded to the CPU when associated VNI interfaces exist. |
3.7.10-3.7.16 | |
| 2545997 |
The NCLU command net show interface produces an error if bonds with no members exist.To work around this issue, remove the empty Bond interfaces from the /etc/network/interfaces file and run sudo ifreload -a. |
3.7.10-3.7.16 | |
| 2545566 |
The Dell Z9100-ON switch incorrectly reports many sensors as ABSENT. | 3.7.12-4.0.1 | 4.1.0-4.4.5 |
| 2545446 |
If you use NCLU commands to add a non-MLAG bond, then add an MLAG configuration, the net commit command fails. However, a subsequent net commit command succeeds. |
3.7.10-3.7.16 | |
| 2545125 |
If you configure more than one VRR interface on an SVI interface, deleting one of the VRR addresses does not remove the interface/address. | 3.7.10-3.7.16, 4.0.0-4.4.5 | |
| 2544978 |
If you delete an undefined bond, then add a bond slave, the net commit command fails. |
3.7.9-3.7.16, 4.0.0-4.4.5 | |
| 2544968 |
FRR configuration commands for an SVI interface might have the \n misplaced in the output. For example:
should be:
To work around this issue, configure the interface manually in the /etc/frr/frr.conf file. |
3.7.9-3.7.16, 4.0.0-4.4.5 | |
| 2544953 |
When you update the hostname of a switch with the NCLU net add hostname command, then run net commit, the lldpd service does not restart and other devices still see the old hostname.To work around this issue, run the sudo systemctl restart lldpd.service command. |
3.7.10-3.7.16, 4.0.0-4.4.5 | |
| 2544904 |
After you delete an IPv6 numbered BGP peer group neighbor, Cumulus Linux might continue to send route advertisements. To work around this issue, restart FRR after removing the IPv6 numbered configuration. |
3.7.9-4.1.1 | 4.2.0-4.4.5 |
| 2544829 |
Frames received with a VLAN tag of 0 on an interface configured as a bridge port and forwarded to the CPU for processing might appear tagged with the native VLAN when viewed with tcpdump. |
3.7.8-3.7.16 | |
| 2544556 |
If you reconfigure an NTP server with NCLU using different trailing options after the IP address (such as iburst), an invalid configuration is added to the /etc/ntp.conf file. For example:
If you need to alter existing server configurations, first remove the server, commit, then re-add the server with any trailing options. |
3.7.9-4.1.1 | 4.2.0-4.4.5 |
| 2544463 |
Auto-negotiation does not work with the QSFP28 cables and a remote system operating at 10G. Attempting to enable auto-negotiation with ethtool -s swp<#> autoneg on returns Operation not supported.To work around this issue, do not use auto-negotiation and set the local port speed to 10G. |
3.7.9-3.7.16, 4.0.0-4.4.5 | |
| 2544456 |
The NCLU net show lldp command displays the speed of a ganged port group as the speed of one of the individual links, rather than the sum of their speeds. |
3.7.9-3.7.16, 4.0.0-4.4.5 | |
| 2544311 |
Applying a policy-based routing (PBR) rule for all traffic from a host might disrupt ARP refresh for that connected host. | 3.7.5-3.7.16, 4.0.0-4.4.5 | |
| 2544155 |
NCLU requires you to specify an interface with multiple address-virtual statements in ascending MAC address order. |
3.7.5-3.7.16, 4.0.0-4.4.5 | |
| 2544113 |
Mac learning is not disabled by default on a double tagged peer link interface resulting in the MAC address changing between the MLAG bond and the peer link. To work around this issue, disable MAC learning on QinQ VLANs by adding bridge-learning off to the VLAN stanza in the etc/network/interfaces file. |
3.7.9-3.7.16, 4.0.0-4.4.5 | |
| 2543900 |
On the Mellanox switch, static VXLAN tunnels incorrectly allow traffic from any remote tunnel IP address. | 3.7.8-3.7.16, 4.0.0-4.4.5 | |
| 2543841 |
The net show evpn vni detail json command includes an extra empty dictionary at the end of the output. |
3.7.8-3.7.16, 4.0.0-4.4.5 | |
| 2543840 |
On the Mellanox SN2700 switch, you cannot enable resilient hashing (RASH) and set the bucket size to 64 in the traffic.conf file. |
3.7.6-3.7.16 | |
| 2543800 |
When local-tunnelip is an SVI, the static VXLAN tunnel does not work; the next hop router receives the packet but drops it as it does not know where to forward the packet. The static VXLAN tunnel does works if local-tunnelip is a loopback or a physical layer 3 interface. |
3.7.8-3.7.16 | 4.0.0-4.4.5 |
| 2543647 |
ERSPAN in ebtables does not work for VNIs. For example, the following rule does not work:
|
3.7.6-4.2.1 | 4.3.0-4.4.5 |
| 2543646 |
In an ebtables rule, ERSPAN (upper case) does not work. You need to specify erspan (lower case). | 3.7.6-3.7.16, 4.0.0-4.4.5 | |
| 2543627 |
Tomahawk 40G DACs cannot disable auto-negotiation. | 3.7.7-3.7.16 | 4.0.0-4.4.5 |
| 2543270 |
The default route injected through OSPF when you configure default-information originate always is unreliable and might age out unexpectedly.To work around this issue, rely on a different source of default route other than injection with default-information originate. |
3.7.8-4.1.1 | 4.2.0-4.4.5 |
| 2543211 |
In some cases, the switchd service might warn of excessive MAC moves from one switch port to itself (for example, from swp18 to swp18). |
3.7.0-3.7.16, 4.0.0-4.4.5 | |
| 2543164 |
The MTU of an SVI cannot be higher than the MTU on the bridge. Changing the MTU on the SVI with NCLU does not update the bridge MTU. The net commit command succeeds even though the MTU is not changed as expected.To work around this issue, change the MTU on all SVIs and the bridge manually in the /etc/network/interfaces file, then apply the change with the ifreload -a command. |
3.7.7-3.7.16, 4.0.0-4.4.5 | |
| 2543096 |
When an SVI with a virtual MAC is configured with a layer 2 VNI in an EVPN environment, if you replace the /etc/network/interfaces file with a different file that does not have the SVI and layer 2 VNI configuration, the original virtual MAC is not populated through the EVPN route until FRR is restarted. |
3.7.6-3.7.16, 4.0.0-4.4.5 | |
| 2543058 |
The IP neighbor entry for a link-local next hop is not installed by FRR, which results in a forwarding failure for routes via that next hop. This is a rare problem that occurs with IPv4 route exchange over IPv6 GUA peering with no IPv4 addresses on the interfaces. To work around this issue, flap the peering to the peer router (which might be a route reflector) to recover. To avoid this issue, configure IPv6 router advertisements on the connecting interfaces. |
3.7.7-3.7.16 | 4.0.0-4.4.5 |
| 2543052 |
Received EVPN type-5 and type-2 MACIP routes are not installed in the kernel (and hardware) routing tables for the associated VRF, which causes traffic to be blackholed. The failure to install the default route causes complete reachability failure for the particular tenant on the affected racks. The routes that are not installed are seen as “inactive” in the routing subsystem (FRR) VRF routing table. This problem is rare and can occur only in EVPN configurations that have user-configured route targets (RTs) for tenant VRFs, and only following a restart of FRR. To work around this issue, either restart the FRR service on the affected switch with the sudo systemctl restart frr.service command or bounce the layer 3 SVI for the affected VRF; for example:
You can run the net show vrf vni command to print a mapping of VRF : L3-VNI : L3-SVI. |
3.7.5-3.7.16 | 4.0.0-4.4.5 |
| 2543044 |
Under certain conditions, EVPN next hops might not be removed when the contributing peer goes down or might not be populated when the BGP session to the contributing peer comes up. You can prevent EVPN next hops from not being removed when the contributing peer goes down by specifying static MAC addresses on all layer 3 VNIs. There is no workaround for preventing EVPN next hops from not being populated when the BGP session to the contributing peer comes up. |
3.7.2-3.7.16 | 4.0.0-4.4.5 |
| 2542979 |
On the Dell-N3048EP-ON switch, when you run the sudo -E apt upgrade command, the upgrade does not work. |
3.7.7-4.1.1 | 4.2.0-4.4.5 |
| 2542945 |
On the Broadcom Maverick switch with a QinQ configuration, the packets coming into the CPU might be tagged incorrectly; for example, 802.1ad + 802.1q tags are expected in the packets but the packets have 802.1q + 802.1q tags. To work around this issue, configure the bridge with bridge-vlan-protocol 802.1ad:
|
3.7.6-3.7.16, 4.0.0-4.4.5 | |
| 2542310 |
hsflow disregards the setting for agent.cidr in the /etc/hsflowd.conf file and selects an IPv6 agent address. The source IP address of the hsflowd packet is IPv4, but the agent address in the hsflow payload shows IPv6. |
3.7.6-3.7.16 | |
| 2542305 |
If an SVI exists in the configuration before you assign it an IP address, when you do assign the IP address with the NCLU command, the vlan-id and the raw-device bridge stanzas are not added automatically. |
3.7.6-3.7.16, 4.0.0-4.4.5 | |
| 2542301 |
When first creating a bond and enslaving an interface, NCLU hides some of the bridge command suggestions, although they are still accepted. |
3.7.3-3.7.16, 4.0.0-4.4.5 | |
| 2541212 |
The maximum-prefix configuration under the IPv4 address family has an optional restart value, which you can configure. This configuration is ignored and, instead of restarting the sessions every x minutes, the peer constantly changes between established and idle due to the prefix count being exceeded. |
3.7.5-3.7.16, 4.0.0-4.4.5 | |
| 2541165 |
On the Dell N3048EP-ON switch, UPOE is supported only on ports 1 thru 12. (UPOE uses all four pairs of standard Ethernet cabling whereas PoE delivers power over two twisted pairs.) When you plug a UPOE device in a port higher than port 12, poectl reports that four_pair_mode_enabled is true. However, this configuration is not supported on the port so poectl should report that four_pair_mode_enabled is false. |
3.7.6-3.7.16 | |
| 2541029 |
On switches with the Trident2 ASIC, 802.1Q-encapsulated control plane traffic received on an interface with 802.1AD configured subinterfaces might be dropped. This issue only affects QinQ configurations. |
3.7.5-3.7.16, 4.0.0-4.4.5 | |
| 2540950 |
On the QuantaMesh T4048-IX8 or EdgeCore AS7326-56X switch, when using a 1000BASE-T SFP module, the module LEDs do not light to reflect link status. |
3.7.3-4.1.1 | 4.2.0-4.4.5 |
| 2540885 |
The Dell N3048EP-ON switch does not support 1G Base-T modules in the SFP ports. | 3.7.7-3.7.16 | |
| 2540863 |
On the EdgeCore AS5812-54X switch, the PSU2 Fan1 fluctuates between OK and LOW. When the fan speed is reported as LOW, the RPM is shown as a negative number. |
3.7.3-3.7.16 | |
| 2540753 |
If the interface alias contains a single or double quotation mark, or an apostrophe, the net show configuration commands fail with the following error:
|
3.7.5-3.7.16, 4.0.0-4.4.5 | |
| 2540444 |
SNMP incorrectly requires engine ID specification. |
3.7.4-3.7.16, 4.0.0-4.4.5 | |
| 2540352 |
When you use NCLU to configure a route map, the parser allows for glob matching of interfaces for a match interface condition when there can only be a single interface matched. The proper syntax is to use multiple route map clauses, each matching a single interface, instead of a single clause matching multiple interfaces. For example, this command is incorrect:
These commands are correct:
|
3.7.2-3.7.16, 4.0.0-4.4.5 | |
| 2540340 |
NCLU allows for the configuration of addresses on VRF interfaces, but tab completion for the net add vrf command just displays
Tab completion for the net add vrf command works correctly. |
3.7.4-3.7.16, 4.0.0-4.4.5 | |
| 2540274 |
On the Maverick switch, CPU forwarded packets might be dropped when there is no route to a leaked host route. | 3.7.5-3.7.16, 4.0.0-4.4.5 | |
| 2540204 |
When links come up after FRR is started, VRF connected routes do not get redistributed. | 3.7.4-3.7.16, 4.0.0-4.4.5 | |
| 2540192 |
The net del bridge bridge mcsnoop yes command does not return the value to the default of disabled. To work around this issue, use the net add bridge bridge mcsnoop no command to delete the mcsnoop attribute and return to the default value. |
3.7.4-3.7.16, 4.0.0-4.4.5 | |
| 2540155 |
On the Broadcom switch, when moving configuration from bridged to routed (or toggling from routed to bridged to routed), some traffic is not seen by the kernel. This can cause BGP to not establish on a transit node. |
3.7.3-3.7.16, 4.0.0-4.4.5 | |
| 2540042 |
When you try to configure the VRRP priority and advertisement-interval with NCLU on a traditional mode bridge, the net commit command fails. To work around this issue, use the vtysh command (inside FRR) to change the VRRP priority or advertisement-interval on traditional bridges. For example:
|
3.7.4-3.7.16, 4.0.0-4.4.5 | |
| 2540041 |
On SVIs in a VLAN-aware bridge, you cannot change the VRRP priority with NCLU. To work around this issue, run the vtysh command inside FRR to change the default priority. For example:
|
3.7.4-3.7.16, 4.0.0-4.4.5 | |
| 2540040 |
Cumulus Linux uses VRRPv3 as the default version, and enables both preempt and accept mode by default. You cannot change these default values with NCLU. To work around this issue, run the vtysh commands (inside FRR) to change the default values. For example:
|
3.7.4-3.7.16, 4.0.0-4.4.5 | |
| 2540031 |
NCLU does not honor auto all in the /etc/network/interfaces file and removes the existing configuration if no individual auto lines exist. |
3.7.3-3.7.16, 4.0.0-4.4.5 | |
| 2539994 |
When you try to remove a BGP peer group configuration with NCLU, the command fails but no warning message is shown. For example:
|
3.7.2-3.7.16, 4.0.0-4.4.5 | |
| 2539962 |
When an LDAP user that does not have NCLU privileges (either in the netshow or netedit group, or in the /etc/netd.conf file) runs an NCLU command, a traceback occurs instead of a permissions error. |
3.7.0-3.7.16, 4.0.0-4.4.5 | |
| 2539670 |
On the Edgecore 4610-54P switch, automatic medium-dependent interface crossover (auto-MDIX) stops working on a 100M full duplex interface and does not detect the required cable connection type. |
3.7.2-3.7.16, 4.0.0-4.4.5 | |
| 2539124 |
The net add interface command adds no ptm-enable for that interface in the frr.conf file. Running the net add or the net del command does not remove no ptm-enable from the frr.conf file. You have to remove it manually using vtysh. |
3.7.2-3.7.16, 4.0.0-4.4.5 | |
| 2539081 |
When you delete post-up and pre-down IP peer entries from the etc/network/interfaces file, then run the ifreload command, the IP addresses are not removed and the route remains in the route table. To work around this issue, either delete the IP addresses without the /32 mask component or flush the IP addresses for the interface with the ip addr flush dev command. |
3.7.0-3.7.16 | 4.0.0-4.4.5 |
| 2538875 |
IPv6 multicast traffic destined to an unregistered multicast group is flooded to all ports in a bridge despite the bridge.optimized_mcast_flood = TRUE setting in the /etc/cumulus/swichd.conf file. |
3.7.2-3.7.16 | |
| 2538790 |
NCLU automatically adds the VLAN ID (for the layer 3 VNI/SVI) to the bridge when you run net add vxlan . This configuration breaks network connectivity in an EVPN symmetric routing configuration using MLAG. To restore connectivity, remove the VLAN ID from the bridge. |
3.7.2-3.7.16, 4.0.0-4.4.5 | |
| 2538590 |
When you configure a control plane ACL to define permit and deny rules destined to the local switch, NCLU programs the control plane ACL rules into the FORWARD chain. |
3.7.2-3.7.16, 4.0.0-4.4.5 | |
| 2538562 |
On an RMP/1G-T switch, when you remove link-speed 100 with the NCLU command or by editing the etc/network/interfaces file to revert the 100M interface to the default (1G auto), the interface fails to recover and does not come back up.After you remove the link-speed, ethtool shows the advertised link modes as not reported and Speed/Duplex as unknown.To work around this issue and bring the interface back up, either restart switchd or use ethtool to configure the speed, advertised, duplex or MDI-X settings. Note: The advertised link mode gets set incorrectly if you include 1000baseT/Half. The port will come up successfully at 1G. |
3.7.2-3.7.16, 4.0.0-4.4.5 | |
| 2538302 |
portwd allows an error to change the module type based on the error. For example, a bad write to a module might cause the module type to flap, which causes the link itself to flap. |
3.7.0-3.7.16 | |
| 2538294 |
If you use NCLU to create an iBGP peering across the peer link, running the net add bgp l2vpn evpn neighbor peerlink.4094 activate command creates a new eBGP neighborship when one has already been configured for iBGP. This is unexpected; the existing iBGP configuration is valid. |
3.7.0-3.7.16, 4.0.0-4.4.5 | |
| 2538256 |
On the Broadcom switch, when a link-local multicast frame is received on an access port with a VNI in the bridge, two copies of the packet are sent across the VNI to remote VTEPs and the receiving hosts observe duplicate packets. |
3.7.2-4.0.1 | 4.1.0-4.4.5 |
| 2537819 |
When you enable FEC (RS or BaseR) on an interface, removing the configuration from that interface does not revert the FEC status to off/none. |
3.7.2-3.7.16 | 4.0.0-4.4.5 |
| 2537699 |
There is a limitation on the number of SVI interfaces you can specify as DHCP relay interfaces in the /etc/default/isc-dhcp-relay file. For example, 1500 SVI interfaces causes the dhcrelay service to exit without a core file and logs similar to the following are generated for the interfaces:
Eventually the dhcrelay service stops. |
3.7.1-3.7.16, 4.0.0-4.4.5 | |
| 2537544 |
When you run the mstpctl command, you might see the bridge-port state as blocking when it is actually disabled. You might see the same incorrect bridge-port state when other programs or tools use the output of mstpctl; for example, SNMP output from the BRIDGE-MIB. |
3.7.1-3.7.16, 4.0.0-4.4.5 | |
| 2537378 |
NCLU SNMPv3 user configuration (add, delete, modify) does not complete. Changes are made to the /etc/snmp/snmpd.conf file but the SNMPv3 user cache file /var/lib/snmp/snmpd.conf fails to update correctly and the configuration does not reflect in operation. To work around this issue, stop snmpd, remove the cache file, then restart snmpd. |
3.7.1-3.7.16 | |
| 2537188 |
When an event in the network, such as a switchd or networking service restart, leads to an OVSDB server high availability transition, an ovs-vtepd core might occur. This core generation has no effect on the functionality of high availability when the active OVSDB server is back in the network. |
3.7.2-3.7.16 | |
| 2537104 |
When you try to stop hsflowd on the Trident II+ switch with the systemctl stop hsflowd command, the process hangs until you stop it with SIGKILL. |
3.7.1-3.7.16 | 4.0.0-4.4.5 |
| 2537061 |
The Dell S5048F-ON switch (with reverse airflow, rear to front), shows the Temp-3 sensor as absent. |
3.7.1-4.0.1 | 4.1.0-4.4.5 |
| 2536608 |
Single tagged ARP requests received on a QinQ-over-VXLAN access port are dropped if ARP suppression is enabled on an unrelated VNI. |
3.7.0-3.7.16 | |
| 2536384 |
The BFD packet redirection logic used by OVSDB server high availability mode redirects BUM packets across the peer link. The iptables rule for redirection does differentiate between BFD and non-BFD VXLAN inner packets because the service node sends all frames with its own IP address as the tunnel source IP address. The VXLAN encapsulated BUM packets do not get forwarded to the CPU and do not go through the iptable redirection rule; only VXLAN encapsulated BFD packets get forwarded to the CPU due to the inner MAC DA lookup in hardware. |
3.7.0-3.7.16, 4.0.0-4.4.5 | |
| 2536179 |
On switches with the Trident 2+ ASIC, counters associated with VLANs and VRFs are not working. | 3.7.0-3.7.16, 4.0.0-4.4.5 | |
| 2535986 |
At a high CPU transmit traffic rate (for example, if there is unexpected CPU generated flooding or replication in software), when the ASIC packet driver cannot keep up with the transmit rate because there are no free DMA buffers, it can back pressure by suspending the switch port transmit queues. This can fill up the application socket buffers resulting in No buffer space available error messages on protocol sockets.When the driver recovers, it automatically resumes the transmit queues. In most cases these error messages are transient. In rare cases, the hardware queues might get stuck, which you can recover with a switchd restart. |
3.7.0-3.7.16, 4.0.0-4.4.5 | |
| 2535965 |
On the Trident3 switch, static PIM with IIF based on a layer 2 bridge does not work reliably. PIM Join via signaling is required for IPMC to work properly. To work around this issue, use dynamic signaling (joins) to manage IP multicast traffic. |
3.7.0-3.7.16, 4.0.0-4.4.5 | |
| 2533691 |
If you configure a VLAN under a VLAN-aware bridge and create a subinterface of the same VLAN on one of the bridge ports, the bridge and interface compete for the same VLAN and if the interface is flapped, it stops working. Correcting the configuration and running the ifreload command does not resolve the conflict. To work around this issue, correct the bridge VIDs and restart switchd or delete the subinterface. |
3.7.12-3.7.16, 4.0.0-4.4.5 | |
| 2532017 |
In FRR, bgp_snmp does not show all BGP peers when peer groups used. |
3.7.11-4.0.1 | 4.1.0-4.4.5 |
Fixed Issues in 3.7.16
| Issue ID | Description | Affects |
|---|---|---|
| 3135801 |
Zebra rejects MAC IP updates from BGP when the MAC mobility sequence number that BGP sends is lower than the sequence number known to zebra When the MAC mobility sequence that BGP knows legitimately lowers (due to narrow timing conditions during convergence or after rebooting an MLAG pair one VTEP at a time), zebra rejects these updates and maintains a stale state. If the stale information that zebra uses points to the wrong VTEP address, traffic goes to the wrong VTEP and might drop. |
3.7.12-3.7.15 |
| 2973714 |
When you configure 199 VXLANs plus 199 VLANs, clagd crashes every few seconds. |
3.7.15, 4.3.0, 4.4.0-4.4.1 |
| 2964279 |
When a VNI flaps, an incorrect list of layer 2 VNIs are associated with a layer 3 VNI. The NCLU net show evpn vni detail command output shows duplicate layer 2 VNIs under a layer 3 VNI. |
3.7.15, 4.4.2-4.4.5 |
| 2959024 |
ACL rules do not always install in hardware after switch reboot To work around this issue, run the sudo cl-acltool -i command to reinstall the ACL rules. |
3.7.14.2-3.7.15 |
| 2943442 |
Cumulus Linux lets you add more than one VXLAN interface to same VLAN on the same bridge. This is an invalid configuration as certain Cumulus Linux components, such as switchd, expect a single VNI for a given bridge or VLAN. |
3.7.15, 4.2.1-4.3.0, 4.4.2-5.0.1 |
| 2940076 |
In a VXLAN fabric with ToR switches configured in a MLAG pair, BUM traffic received on a VXLAN tunnel is decapsulated and forwarded on the peer link bond. The BUM traffic is then encapsulated by the peer switch and sent back to the fabric. The issue has been seen in environments where the following conditions exist at the same time:1) high VNI scale2) switchd is busy processing updates3) clagd is in a transition state, such as Up, then Down, then Up. For example, when clagd restarts, the switch reboots, and so onThe problem is seen on the switch that experiences the clagd state transition. |
3.7.12-3.7.15 |
| 2940063 |
Under certain high scale conditions, various modules might experience timetouts during cl-support collection, which results in missing data in the cl-support file. | 3.7.12-3.7.15, 4.1.1-4.3.0 |
| 2940052 |
When you configure the switch with the minimum reserved VLAN of 150 and the internal VLANs are exhausted, the MLAG peer does not forward the VLAN. | 3.7.15, 4.2.1-4.3.0 |
| 2940051 |
In an MLAG configuration with traditional bridges, MAC addresses are seen over peer link during ifreload when adding new VLANS or bridges. |
3.7.14.2-3.7.15, 4.3.0-4.4.5 |
| 2934940 |
When you change the SVI vlan-id value in the /etc/network/interfaces file, then run ifreload -a, the 802.1Q ID for the SVI in the kernel does not change.This operation is not supported in the kernel without recreating the SVI. To apply the change, run ifdown, then ifup for the SVI to recreate the interface. |
3.7.13-3.7.15, 4.2.1 |
| 2934938 |
When the clagd process terminates unexpectedly due to signals such as sig11 or sig6, no core file is generated. |
3.7.15 |
| 2934935 |
VXLAN route updates during high frequency might cause switchd to leak memory. |
3.7.14.2-3.7.15 |
| 2923737 |
When switchd restarts, the port watch daemon (portwd) attempts to send requests to switchd before switchd is ready. As a result, portwd goes into a failed state because there is no response from switchd. |
3.7.15 |
| 2879645 |
When you add a new VLAN, the VLAN interface type shows as unknown and cannot be reached. |
3.7.15 |
| 2875279 |
In a scaled EVPN-MLAG configuration (observed with 400 or more VNIs and 20K or more MAC addresses – the actual scale might vary), when the peer link flaps causing all VNIs to come up at the same time, there might be high CPU utilization on the system for several minutes and the FRR service might restart. After FRR restarts or the CPU utilization settles down, the system functions normally. | 4.2.1-4.3.0, 4.4.0-5.0.1 |
| 2848219 |
On the Dell S3048 switch configured for 802.1x authentication, you might see file descriptor exhaustion with hostapd messages indicating that Cumulus Linux is unable to open /dev/urandom or write out the transient ACL files. To work around this issue, reboot the switch. |
4.3.0 |
| 2821970 |
When there is a netlink event showing an update to a forwarding database entry from the VXLAN driver, ip monitor reports the remote VTEP address (dst) as ??? . The bridge monitor command correctly shows the value. |
3.7.15 |
| 2817130 |
The cl-route-check –layer3 command fails with a memory error. For example:cumulus@switch:~$ sudo cl-route-check –layer3Traceback (most recent call last): |
3.7.15 |
| 2815592 |
In an EVPN configuration, an FRR restart on a border leaf VRRP master causes a stale route for the VRRP VIP on some remote VTEPs to point to the VRRP backup after convergence. | 3.7.12-3.7.15, 4.3.0, 4.4.2-5.0.1 |
| 2803044 |
In an EVPN configuration with IP or MAC mobility, higher MM EVPN routes do not remove the old ARP entries during VIP migration between VTEP racks. | 3.7.14.2-3.7.15 |
| 2801262 |
On NVIDIA Spectrum ASICs in a layer 2 bridge scaled configuration (more than 800 VLANs), clagd.service enters a failed state after a reboot or a switchd restart. |
3.7.12-3.7.15, 4.3.0, 4.4.2-4.4.5 |
| 2799742 |
On the Edgecore AS4610 switch, the historic CPU usage displayed in /run/sysmonitor/history sometimes shows as a negative value. |
4.2.1-4.3.0 |
| 2794750 |
When a multipath route that contains an EVPN path exists together with an IPv4 BGP path in the VRF, the RMAC to VTEP binding is incorrect. This invalid entry occurs because Cumulus Linux treats IPv4 routes received over the eBGP IPv4 peering incorrectly in the VRF. To work around this issue, remove the unnecessary eBGP IPv4 peering. |
3.7.12-3.7.15, 4.0.0-4.2.1 |
| 2736265 |
After an apt upgrade, the OPTIONS configuration line in /etc/default/isc-dhcp-relay might be removed. To work around this issue, reconfigure the desired options in the file after the upgrade completes. |
3.7.12-3.7.15, 4.2.1-4.3.0 |
| 2717312 |
When you modify a prefix list with NCLU commands, the bgpd service crashes. |
3.7.14.2-3.7.15 |
| 2700767 |
Following an event that causes the peerlink bond MAC address to change, such as a slave port state change, MLAG interfaces might be suspended due to a peer IP mismatch. This behavior is seen when you use a MLAG peer IP linklocal configuration. | 3.7.12-3.7.15, 4.3.0-4.4.5 |
| 2690100 |
When you run the vtysh show ip bgp vrf command, the bgpd service crashes if you use vrf all. For example:spine01# show ip bgp vrf all statistics vtysh: error reading from bgpd: Success (0)Warning: closing connection to bgpd because of an I/O error! spine01# show bgp vrf all ipv6 unicast statistics To workaround this issue, run the command against each VRF independently. |
3.7.15, 4.0.0-4.3.0 |
| 2669831 |
If you try to remove BFD configuration with systemctl reload frr, the FRR service fails. The reload action results in a TypeError: expected string or bytes-like object errorYou see this issue only if there is default configuration, such as configuration in the /etc/frr/frr.conf file that is suppressed from view in the FRR running configurationTo work around this issue, remove the default configuration lines; for example: username cumulus nopassword |
3.7.14.2-3.7.15 |
| 2668483 |
If you update the MAC address of an SVI using ifreload and hwaddress, the kernel maintains a stale permanent FDB entry for the old MAC address. |
3.7.15, 4.3.0, 4.4.0-4.4.3, 5.0.0-5.0.1 |
| 2660582 |
In an MLAG configuration, the secondary MLAG switch does not use a unique address instead of the MLAG system MAC address when there is a double failure (backup IP and peer link failure) To recover restart the clagd service with sudo systemctl restart clagd.service |
3.7.8-3.7.15 |
| 2645846 |
When 802.1x MAB and a parking VLAN are configured on an interface, hostapd might install a static fdb entry if the interface is down. To work around this issue, delete 802.1x from the interface with the net del interface command, then add back the 802.1x configuration. |
3.7.10-3.7.15 |
| 2638400 |
When you stop clagd on the MLAG primary switch (for example, when you reboot the switch), in rare conditions the MLAG secondary switch might fail to properly assert itself as the MLAG primary switch. To work around this issue, change the primary designation by configuring the clagd priorities to ensure that you only reboot a switch that is in the MLAG secondary role. |
3.7.15, 4.3.0 |
| 2581473 |
When netq-agent is installed on the Dell N3048EP platform, switchd might crash if pluggables are installed in the SFP+ ports. | 3.7.13-3.7.15 |
| 2548044 |
When a remote VTEP withdraws a type-3 EVPN route, Cumulus Linux purges all MAC address and neighbor entries installed in the corresponding layer 2 VNI through that remote VTEP from the local EVPN and kernel forwarding tables. This purge occurs even if the remote VTEP does not withdraw type-2 routes carrying the MAC address or neighbor entries. The entries stay missing from the local EVPN and kernel forwarding tables until BGP updates the MAC address and neighbor. | 3.7.12-3.7.15, 4.0.0-4.4.5 |
3.7.15 Release Notes
Open Issues in 3.7.15
| Issue ID | Description | Affects | Fixed |
|---|---|---|---|
| 3410952 |
If MLAG is configured but disconnected from an MLAG peer for an extended period of time (days or more), there is a long delay (up to a minute per day) before traffic forwarding stabilizes after the MLAG peer connection re-establishes. | 3.7.0-4.3.1 | 4.3.2-4.4.5, 5.5.0-5.15.0 |
| 3376798 |
On Broadcom switches, Cumulus Linux does not create the hardware bridging domain for a traditional bridge with a VXLAN interface during switchd restart. The /var/log/switchd.log file includes the following exception logs shortly after switchd restarts:switchd[30158]: hal_bcm_l3.c:1617 find_egr_path_if_vxlan_overlay:vxlan overlay : nh PORT: port <#>, vlanMAC learning looks correct, but traffic does not flow as expected. |
3.7.0-4.3.1 | 4.3.2-4.4.5 |
| 3330705 |
When using TACACS+, a TACACS+ server name that returns more than one IP address, such as an IPv6 and IPv4 address, is counted many times against the limit of seven TACACS+ servers, which might cause some of the later listed servers to be ignored as over the limit. To work around this issue, you can set the prefer_ip_version configuration option (the default value is 4) to choose between an IPv4 or IPv6 address if both are present. |
3.7.0-5.3.1 | 5.4.0-5.15.0 |
| 3327477 |
If you use su to change to a user specified through TACACS+, the user becomes the local tacacs0 thru tacacs15 user instead of the named user to run sudo commands. As a result, the named user password might not match the local tacacs0 thru tacacs15 user password. |
3.7.0-3.7.16, 4.0.0-4.4.5, 5.0.0-5.15.0 | |
| 3216921 |
RADIUS authenticated users with read-only access to NCLU commands (users in the users_with_show list) can run edit commands if a username for a non-local account is on the users_with_edit line of the /etc/netd.conf file. To work around this issue, make sure that all usernames on the users_with_edit line of the /etc/netd.conf file are configured local users for the system (real Linux users) |
3.7.0-3.7.16, 4.3.0-4.4.5 | |
| 3216759 |
With the ip-acl-heavy TCAM profile, the following message might appear after you install an ACL with NCLU or cl-acltool and the ACL might not work correctlyhal_flx_acl_util.c:378 ERR hal_flx_acl_resource_release resource region 0 size 7387 create failed: No More ResourcesTo work around this issue, change the TCAM profile to acl-heavy or ip-acl-heavy with ACL non-atomic mode. |
3.7.15-3.7.16, 4.3.0-4.4.5 | |
| 3209699 |
RADIUS authenticated users with read-only access to NCLU commands (users in the users_with_show list) can run edit commands if a username for a non-local account is on the users_with_edit line of the /etc/netd.conf file. To work around this issue, make sure that all usernames on the users_with_edit line of the /etc/netd.conf file are configured local users for the system (real Linux users) |
3.7.0-4.3.0, 4.4.0-5.2.1 | 4.3.1, 5.3.0-5.15.0 |
| 3135801 |
Zebra rejects MAC IP updates from BGP when the MAC mobility sequence number that BGP sends is lower than the sequence number known to zebra When the MAC mobility sequence that BGP knows legitimately lowers (due to narrow timing conditions during convergence or after rebooting an MLAG pair one VTEP at a time), zebra rejects these updates and maintains a stale state. If the stale information that zebra uses points to the wrong VTEP address, traffic goes to the wrong VTEP and might drop. |
3.7.12-4.3.0 | 4.3.1-4.4.5 |
| 3129819 |
On the EdgeCore AS4610 switch, the clagd service loses communication after 198 days of uptime. |
3.7.15-3.7.16 | |
| 3120423 |
When you configure an interface in FRR to send IPv6 RAs before you configure the interface in the /etc/network/interfaces file, the switch does not process IPv6 RAs. To work around this issue, remove the interface configuration in FRR and reapply it. |
3.7.15-4.3.0, 4.4.0-5.1.0 | 4.3.1, 5.2.0-5.15.0 |
| 3093966 |
On Broadcom switches, INPUT chain iptable rules filter IPv6 packets matching the rules. | 3.7.15-3.7.16, 4.3.0-4.4.5 | |
| 3073668 |
On the EdgeCore AS4610 switch, when you change the speed of any of the SFP+ ports, the other SFP+ ports flap. | 3.7.12-3.7.16, 4.3.0-4.4.5 | |
| 3072674 |
In an MLAG configuration, if you put a single connected interface into an admin down state, any dynamic MAC addresses on the peer link are flushed, then added back, which causes momentary traffic disruption. |
3.7.15-5.1.0 | 5.2.0-5.15.0 |
| 3072613 |
When you delete a bond interface with NCLU, BGP peer group configuration is removed. | 3.7.15-3.7.16, 4.3.0-4.4.5 | |
| 3066704 |
The hostapd service stops working if an 802.1X interface goes up and down many times over a long period of timeTo work around this issue, restart the hostapd service with the systemctl restart hostapd command. |
3.7.15-4.3.0 | 4.3.1-4.4.5 |
| 3053063 |
The update-ports.service fails because a blank space in the comment lines of the /etc/cumulus/ports.conf file causes parsing errors. To work around this issue, remove the blank spaces in the commented lines, then restart the update-ports and switchd services. |
3.7.15-4.3.0 | 4.3.1-4.4.5, 4.4.4-4.4.5 |
| 3020254 |
When ARP suppression is off, GARPs from neighmgrd for remote neighbors are sent over VXLAN. |
3.7.15-4.3.0, 4.4.0-4.4.3, 5.0.0-5.1.0 | 4.3.1, 4.4.4-4.4.5, 5.2.0-5.15.0 |
| 3017190 |
When you power cycle the switch, multiple interfaces came up in a PoE disabled state To work around this issue, run the sudo poectl -a | grep disabled command to find ports with disabled POE. Run the sudo poectl -e swp1-swp48 command to enable POE on affected ports. |
3.7.10-3.7.16 | |
| 3015881 |
Traffic flows fail because the remote VTEP IP address is missing in the layer 3 neighbor table in hardware on the switch. This happens when there is a neighbor entry for the same /32 that we have also received a type-5 route for. When the route is learned after the neighbor entry there is a timing condition that can be hit that will cause the neighbor entry to get removed from hardware when the route is installed in hardware This condition has been seen when customers re-use the VTEP IP on an interface inside of a vrf. The neigh entry for the TEP IP is installed when a symmetric route is learned via that VTEP. The Type-5 route for the TEP IP is learned in the VRF if the customer has redistributed it or advertised it within BGP in the VRF. |
3.7.15-3.7.16 | |
| 2993719 |
After you delete the last vxlan-remoteip configuration line from the /etc/network/interfaces file and run the ifreload -a command, the corresponding BUM flood entry is not removed. This is issue is impacting all Cumulus Linux releases. The following attribute: vxlan-purge-remotes yes is intended to fix the issue (this attribute has been available since CL2). It was decided to change ifupdown2’s default behavior to automatically purge BUM entries added by ifup/ifreload. |
3.7.15-5.0.1 | 5.1.0-5.15.0, 5.2.0-5.15.0 |
| 2991514 |
Cumulus Linux can take a long time (100 seconds) to sync a large number of VNIs on a bridge. | 3.7.15-4.3.0 | 4.3.1-4.4.5 |
| 2973714 |
When you configure 199 VXLANs plus 199 VLANs, clagd crashes every few seconds. |
3.7.15-4.3.0, 4.4.0-4.4.1 | 4.3.1, 4.4.2-4.4.5, 5.0.0-5.15.0 |
| 2972538 |
With RADIUS enabled for user shell authentication, there might be a delay in local user authentication for non cumulus user accounts. | 3.7.15-3.7.16 | |
| 2965759 |
On the EdgeCore AS4610-54T switch, the fan speed reports a minimum threshold in the logs. | 3.7.15-3.7.16 | |
| 2964279 |
When a VNI flaps, an incorrect list of layer 2 VNIs are associated with a layer 3 VNI. The NCLU net show evpn vni detail command output shows duplicate layer 2 VNIs under a layer 3 VNI. |
3.7.15, 4.4.2-4.4.5 | 3.7.16 |
| 2959067 |
ECMP produces errors indicating No More Resources and switchd crashes even when ECMP utilization is low. |
3.7.14.2-4.2.1 | 4.3.0-4.4.5 |
| 2959024 |
ACL rules do not always install in hardware after switch reboot To work around this issue, run the sudo cl-acltool -i command to reinstall the ACL rules. |
3.7.14.2-3.7.15 | 3.7.16 |
| 2951110 |
The net show time ntp servers command does not show any output with the management VRF. |
3.7.15-3.7.16, 4.1.1-4.4.5, 5.0.0-5.15.0 | |
| 2947679 |
If the clagd service stops during initDelay, the peerlink flag does not clear from any VNIs that become dual connected during this time. switchd uses the peerlink flag to program MLAG loop prevention. As a result of the overlapping stale flags, traffic destined for the VXLAN might drop. |
3.7.15-3.7.16 | |
| 2943442 |
Cumulus Linux lets you add more than one VXLAN interface to same VLAN on the same bridge. This is an invalid configuration as certain Cumulus Linux components, such as switchd, expect a single VNI for a given bridge or VLAN. |
3.7.15-4.3.0, 4.4.2-5.0.1 | 4.3.1, 5.1.0-5.15.0 |
| 2940076 |
In a VXLAN fabric with ToR switches configured in a MLAG pair, BUM traffic received on a VXLAN tunnel is decapsulated and forwarded on the peer link bond. The BUM traffic is then encapsulated by the peer switch and sent back to the fabric. The issue has been seen in environments where the following conditions exist at the same time:1) high VNI scale2) switchd is busy processing updates3) clagd is in a transition state, such as Up, then Down, then Up. For example, when clagd restarts, the switch reboots, and so onThe problem is seen on the switch that experiences the clagd state transition. |
3.7.12-3.7.15 | 3.7.16 |
| 2940063 |
Under certain high scale conditions, various modules might experience timetouts during cl-support collection, which results in missing data in the cl-support file. | 3.7.12-3.7.15, 4.1.1-4.3.0 | 3.7.16, 4.3.1-4.4.5, 5.0.0-5.15.0 |
| 2940052 |
When you configure the switch with the minimum reserved VLAN of 150 and the internal VLANs are exhausted, the MLAG peer does not forward the VLAN. | 3.7.15-4.3.0 | 4.3.1-4.4.5 |
| 2940051 |
In an MLAG configuration with traditional bridges, MAC addresses are seen over peer link during ifreload when adding new VLANS or bridges. |
3.7.14.2-3.7.15, 4.3.0-4.4.5 | 3.7.16, 5.0.0-5.15.0 |
| 2934940 |
When you change the SVI vlan-id value in the /etc/network/interfaces file, then run ifreload -a, the 802.1Q ID for the SVI in the kernel does not change.This operation is not supported in the kernel without recreating the SVI. To apply the change, run ifdown, then ifup for the SVI to recreate the interface. |
3.7.13-4.2.1 | 4.3.0-4.4.5 |
| 2934939 |
When you configure BGP aggregate-address summary-only and any component route within the summary updates, all component routes within the summary update in the RIB on the device advertising the summary. This condition might result in increased CPU usageTo workaround this issue, remove the aggregate-address summary-only configuration, add a static route to Null0 for the prefix, and configure an outbound route map to restrict anything more specific than the desired prefix from being advertised. For example: Before:address-family ipv4 unicastAfter: ip route 10.10.0.0/16 Null0This example assumes no other static routes are present. Otherwise, you might need to configure additional route maps to limit the static routes being redistributed. |
3.7.12-3.7.16 | |
| 2934938 |
When the clagd process terminates unexpectedly due to signals such as sig11 or sig6, no core file is generated. |
3.7.15-3.7.16 | |
| 2934935 |
VXLAN route updates during high frequency might cause switchd to leak memory. |
3.7.14.2-4.3.0 | 4.3.1-4.4.5 |
| 2923737 |
When switchd restarts, the port watch daemon (portwd) attempts to send requests to switchd before switchd is ready. As a result, portwd goes into a failed state because there is no response from switchd. |
3.7.15 | 3.7.16, 4.3.1-4.4.5 |
| 2910017 |
SNMP reports the same ifType of ethernetCsmacd(6) for loopback interfaces. |
3.7.15-4.4.2, 5.0.0-5.0.1 | 4.4.3-4.4.5, 5.1.0-5.15.0 |
| 2899413 |
Broadcom switches return a table full error when creating VXLAN gports, which causes switchd to crash. |
3.7.15-4.3.0 | 4.3.1-4.4.5 |
| 2879645 |
When you add a new VLAN, the VLAN interface type shows as unknown and cannot be reached. |
3.7.15 | 3.7.16 |
| 2866084 |
When you reboot a VTEP, MAC address entries might become out of sync between the kernel FDB table and the EVPN MAC VNI table on remote VTEPs. The impacted MAC entries are installed against the rebooted VTEP IP address in the kernel FDB and the correct VTEP IP is present in the EVPN MAC VNI table. To work around this issue, clear all corrupted MAC address entries in the kernel FDB with the bridge fdb del dev command, then add “vxlan-learning”: “off” in the /etc/network/ifupdown2/policy.d/vxlan.json file:$ cat /etc/network/ifupdown2/policy.d/vxlan.jsonReboot the affected switches. |
3.7.12-4.3.0 | 4.3.1-4.4.5 |
| 2866061 |
On the Maverick S4148T switch with MLAG, Cumulus Linux drops LACP, ARP, LLDP and BGP traffic. | 3.7.12-3.7.16 | |
| 2859177 |
The cl-route-check –layer3 command fails with a memory error. For example:cumulus@switch:~$ sudo cl-route-check –layer3Traceback (most recent call last): |
3.7.15-3.7.16 | |
| 2855908 |
Traffic failover in a multicast topology with redundancy has the mroute stuck in a prune state and PIM join messages continue to send To work around this issue, run the vtysh clear ip mroute command. |
3.7.15-4.3.0, 4.4.0-5.0.1 | 4.3.1, 5.1.0-5.15.0 |
| 2853536 |
MLAG between Cumulus Linux and Arista devices might result in some links being suspended by the Arista devices with the error LACP partner validation failedThis happens when you use the same LACP port ID for more than one bond member on the Cumulus Linux switch To work around this issue, run the net add bond command on the bond on the Cumulus Linux switch. For proper operation, you need to make the equivalent change on the device on the other side of the link. |
3.7.15-3.7.16 | |
| 2827336 |
After bringing up a bridge port, there is a multi second delay before the bridge port is able to learn any MAC addresses or neighbors, which causes a forwarding delay (about six seconds with 300 or more VLANs). | 3.7.15-3.7.16 | |
| 2821970 |
When there is a netlink event showing an update to a forwarding database entry from the VXLAN driver, ip monitor reports the remote VTEP address (dst) as ??? . The bridge monitor command correctly shows the value. |
3.7.15 | 3.7.16 |
| 2817130 |
The cl-route-check –layer3 command fails with a memory error. For example:cumulus@switch:~$ sudo cl-route-check –layer3Traceback (most recent call last): |
3.7.15 | 3.7.16, 5.0.0-5.15.0 |
| 2815592 |
In an EVPN configuration, an FRR restart on a border leaf VRRP master causes a stale route for the VRRP VIP on some remote VTEPs to point to the VRRP backup after convergence. | 3.7.12-3.7.15, 4.3.0, 4.4.2-5.0.1 | 3.7.16, 4.3.1, 5.1.0-5.15.0 |
| 2803044 |
In an EVPN configuration with IP or MAC mobility, higher MM EVPN routes do not remove the old ARP entries during VIP migration between VTEP racks. | 3.7.14.2-3.7.15 | 3.7.16 |
| 2801262 |
On NVIDIA Spectrum ASICs in a layer 2 bridge scaled configuration (more than 800 VLANs), clagd.service enters a failed state after a reboot or a switchd restart. |
3.7.12-3.7.15, 4.3.0, 4.4.2-4.4.5 | 3.7.16, 4.3.1, 5.0.0-5.15.0 |
| 2798979 |
Configuring a route map to filter VNIs will cause type-3 routes not to be advertised even for L2VNIs permitted through the route map | 3.7.15-3.7.16 | |
| 2794750 |
When a multipath route that contains an EVPN path exists together with an IPv4 BGP path in the VRF, the RMAC to VTEP binding is incorrect. This invalid entry occurs because Cumulus Linux treats IPv4 routes received over the eBGP IPv4 peering incorrectly in the VRF. To work around this issue, remove the unnecessary eBGP IPv4 peering. |
3.7.12-4.2.1 | 4.3.0-4.4.5 |
| 2792750 |
If you change the clagd-vxlan-anycast-ip setting on both MLAG peers at the same time, both peers use their unique VTEP address indefinitely. |
3.7.15-4.3.0, 4.4.0-4.4.5 | 4.3.1 |
| 2754791 |
Remote MAC addreses in zebra are out of sync with bgpd. The zebra MAC addresses point to an incorrect (old) VTEP IP address and the sequence number is one higher than in BGP. |
3.7.14.2-3.7.16, 4.3.0-4.4.5 | |
| 2743186 |
When you use MD5 passwords and you configure a non-default VRF before the default VRF in the /etc/frr/frr.conf file, numbered BGP sessions do not establish. |
3.7.15-5.1.0 | 5.2.0-5.15.0 |
| 2736265 |
After an apt upgrade, the OPTIONS configuration line in /etc/default/isc-dhcp-relay might be removed. To work around this issue, reconfigure the desired options in the file after the upgrade completes. |
3.7.12-4.3.0 | 4.3.1-4.4.5, 4.4.0-4.4.5 |
| 2730225 |
When withdrawal and advertisement processing occurs in short succession, type-2 routes with an IP are not imported into layer 2 VNIs. | 3.7.12-4.3.0 | 4.3.1-4.4.5, 4.4.2-4.4.5 |
| 2717312 |
When you modify a prefix list with NCLU commands, the bgpd service crashes. |
3.7.14.2-3.7.15 | 3.7.16 |
| 2716822 |
The /etc/cumulus/ports.conf file on the Dell Z9264F-ON switch does not show that Cumulus Linux does not support the 2x10G SFP+ ports. |
3.7.15-4.3.0 | 4.3.1-4.4.5 |
| 2713888 |
With the ip-acl-heavy TCAM profile, the following message might appear after you install an ACL with NCLU or cl-acltool and the ACL might not work correctlyhal_flx_acl_util.c:378 ERR hal_flx_acl_resource_release resource region 0 size 7387 create failed: No More ResourcesTo work around this issue, change the TCAM profile to acl-heavy or ip-acl-heavy with ACL non-atomic mode. |
3.7.15-5.0.1 | 5.1.0-5.15.0 |
| 2700767 |
Following an event that causes the peerlink bond MAC address to change, such as a slave port state change, MLAG interfaces might be suspended due to a peer IP mismatch. This behavior is seen when you use a MLAG peer IP linklocal configuration. | 3.7.12-3.7.15, 4.3.0-4.4.5 | 3.7.16 |
| 2690100 |
When you run the vtysh show ip bgp vrf command, the bgpd service crashes if you use vrf all. For example:spine01# show ip bgp vrf all statistics vtysh: error reading from bgpd: Success (0)Warning: closing connection to bgpd because of an I/O error! spine01# show bgp vrf all ipv6 unicast statistics To workaround this issue, run the command against each VRF independently. |
3.7.15, 4.0.0-4.3.0 | 3.7.16, 4.3.1-4.4.5 |
| 2687332 |
When you configure BGP aggregate-address summary-only and any component route within the summary updates, all component routes within the summary update in the RIB on the device advertising the summary. This condition might result in increased CPU usageTo workaround this issue, remove the aggregate-address summary-only configuration, add a static route to Null0 for the prefix, and configure an outbound route map to restrict anything more specific than the desired prefix from being advertised. For example: Before:address-family ipv4 unicastAfter: ip route 10.10.0.0/16 Null0This example assumes no other static routes are present. Otherwise, you might need to configure additional route maps to limit the static routes being redistributed. |
3.7.12-4.2.1 | 4.3.0-4.4.5 |
| 2684452 |
When a VTEP is rebooted, MAC address entries might become out of sync between the kernel fdb table and the EVPN MAC VNI table on remote VTEPs. The impacted MAC entries will be installed against the rebooted VTEP IP in the kernel fdb and the correct VTEP IP will be present in the EVPN MAC VNI table You can work around this issue with the following steps:1. Clear all corrupted mac entries in the kernel FDB with the bridge fdb del dev command2. Add “vxlan-learning”: “off” under /etc/network/ifupdown2/policy.d/vxlan.json$ cat /etc/network/ifupdown2/policy.d/vxlan.json3. Reboot the affected switch(es) |
3.7.12-3.7.16 | |
| 2669831 |
If you try to remove BFD configuration with systemctl reload frr, the FRR service fails. The reload action results in a TypeError: expected string or bytes-like object errorYou see this issue only if there is default configuration, such as configuration in the /etc/frr/frr.conf file that is suppressed from view in the FRR running configurationTo work around this issue, remove the default configuration lines; for example: username cumulus nopassword |
3.7.14.2-3.7.15 | 3.7.16 |
| 2669438 |
Editing the /etc/frr/frr.conf file to add a new sequence at the beginning of an existing large prefix list changes the subsequent sequence numbers of the next entries in the list and FRR reload might fail with the error message frr.service reload operation timed out. Stopping. To work around this issue, instead of adding the new prefix using an existing sequence number and pushing other sequences forward, use a sequence number that is free; for example, instead of of using 5 -> 10 -> 15, use 5 -> 7 -> 10. |
3.7.11-3.7.16 | |
| 2668483 |
If you update the MAC address of an SVI using ifreload and hwaddress, the kernel maintains a stale permanent FDB entry for the old MAC address. |
3.7.15-4.3.0, 4.4.0-4.4.3, 5.0.0-5.0.1 | 4.3.1, 4.4.4-4.4.5, 5.1.0-5.15.0 |
| 2660582 |
In an MLAG configuration, the secondary MLAG switch does not use a unique address instead of the MLAG system MAC address when there is a double failure (backup IP and peer link failure) To recover restart the clagd service with sudo systemctl restart clagd.service |
3.7.8-3.7.15 | 3.7.16 |
| 2653400 |
When 802.1x MAB and a parking VLAN are configured on an interface, hostapd might install a static fdb entry if the interface is down. To work around this issue, delete 802.1x from the interface with the net del interface command, then add back the 802.1x configuration. |
3.7.10-3.7.16 | |
| 2648658 |
If you try to use more than one percent of max-ecmp-nexthops, you get an error indicating a failure. |
3.7.15-4.3.3 | 4.4.0-4.4.5 |
| 2645846 |
When 802.1x MAB and a parking VLAN are configured on an interface, hostapd might install a static fdb entry if the interface is down. To work around this issue, delete 802.1x from the interface with the net del interface command, then add back the 802.1x configuration. |
3.7.10-3.7.15 | 3.7.16, 4.3.1-4.4.5 |
| 2638400 |
When you stop clagd on the MLAG primary switch (for example, when you reboot the switch), in rare conditions the MLAG secondary switch might fail to properly assert itself as the MLAG primary switch. To work around this issue, change the primary designation by configuring the clagd priorities to ensure that you only reboot a switch that is in the MLAG secondary role. |
3.7.15, 4.3.0 | 3.7.16, 4.3.1-4.4.5, 4.4.0-4.4.5 |
| 2638137 |
When you delete a static route using NCLU, the configuration is not deleted from the running configuration or from the /etc/frr/frr.conf file. |
3.7.13-3.7.16 | |
| 2633245 |
On the Dell N3048EP-ON switch, the SPF+ ports remain down after a power cycle. | 3.7.10-3.7.16 | |
| 2607965 |
On the EdgeCore AS7726 switch, when you run the NCLU net show system command, you see the error Command not found. |
3.7.14.2-3.7.16 | |
| 2581473 |
When netq-agent is installed on the Dell N3048EP platform, switchd might crash if pluggables are installed in the SFP+ ports. | 3.7.13-3.7.15 | 3.7.16 |
| 2562347 |
When you bring VXLAN interfaces up and down physically or administratively, the MTU for the SVIs changes to 1550 (the default value). | 3.7.14.2-3.7.16 | |
| 2556037 |
After you add an interface to the bridge, an OSPF session flap might occur |
3.7.9-4.2.0 | 4.2.1-4.4.5 |
| 2555908 |
If the you add the MLAG backup IP address to the MLAG peer in the secondary role while the peer link is down, the LACP sys-mac does not use the MLAG system MAC address (clagd-sys-mac) when the peer link comes back up To work around this issue, wait until the peer link is up to add the MLAG backup IP address. To recover from this condition, restart clagd with the sudo systemctl restart clagd command. |
3.7.12-4.0.1 | 4.1.0-4.4.5 |
| 2555528 |
In an EVPN Active/Active configuration, when one of the peers reboots and begins to refresh IP neighbor entries shared by the MLAG peer, some of these ARP messages might be dropped by the MLAG peer’s ARP policer. To work around this issue, increase the burst value of the ARP policers to 200 or higher. |
3.7.14-4.2.1 | 4.3.0-4.4.5 |
| 2555175 |
Control plane traffic (such as BGP peering from leaf to spine) goes down on the leaf due to the peer Hold Down timer expiration following prolonged link flaps on down links when VXLAN enabled VLANs are carried on the flapping link. Be sure to correct layer 1 issues, configuration issues, or misbehaving link partners that are causing the link flaps. | 3.7.15-4.3.1 | 4.3.2-4.4.5 |
| 2554785 |
After you reboot a Broadcom switch, switchd might fail to restart and you see logs in switchd.log similar to the following:Nov 12 12:20:05.063876 leaf01 switchd[9867]:Nov 12 12:20:05.064310 leaf01 switchd[9867]: hal_bcm_console.c:294 0:system_init:Nov 12 12:20:05.064428 leaf01 switchd[9867]: hal_bcm_console.c:294 system_init: Misc init failed: Operation timed outNov 12 12:20:05.064464 leaf01 switchd[9867]:Nov 12 12:20:05.091995 leaf01 switchd[9867]: hal_bcm_console.c:294 LED: Loading 256 bytes into LED program memoryNov 12 12:20:05.092029 leaf01 switchd[9867]:Nov 12 12:20:05.099547 leaf01 switchd[9867]: hal_bcm_console.c:294 PORT: Error: bcm ports not initializedNov 12 12:20:05.099579 leaf01 switchd[9867]:Nov 12 12:20:05.099646 leaf01 switchd[9867]: hal_bcm_console.c:294 Error: file /var/lib/cumulus/rc.datapath_0: line 81 (error code -1): script terminatedNov 12 12:20:05.099667 leaf01 switchd[9867]:Nov 12 12:20:05.099775 leaf01 switchd[9867]: hal_bcm_console.c:294 Error: file /etc/bcm.d/rc.soc: line 70 (error code -1): script terminatedNov 12 12:20:05.099798 leaf01 switchd[9867]:Nov 12 12:20:05.099871 leaf01 switchd[9867]: hal_bcm_console.c:294 ERROR loading rc script on unit 0Nov 12 12:20:05.099892 leaf01 switchd[9867]:Nov 12 12:20:05.099943 leaf01 switchd[9867]: hal_bcm_console.c:299 CRIT loading of rc script failed, aborting!To work around this issue, configure Cumulus Linux to boot with the ntel_iommu=off kernel command option:1. Open the /etc/default/grub file with a text editor2. Edit the GRUB_CMDLINE_LINUX variable by adding the string intel_iommu=off at the end. For example: GRUB_CMDLINE_LINUX=“cl_platform=cel_e1031 console=ttyS1,115200n8 intel_iommu=off"3. Run the update-grub command4. Reboot the switch. |
3.7.11-4.2.1 | 4.3.0-4.4.5 |
| 2554709 |
The IP address specified in the ip pim use-source command configured on the loopback interface should be inherited by unnumbered interfaces during their Primary IP address selection process. If ip pim use-source is configured on the loopback after an unnumbered interface has already selected their Primary IP address, the unnumbered interface does not update its Primary IP address to be the new use-source value until after there is a netlink update for that interface.To work around this issue, configure ip pim use-source on each unnumbered interface directly or ensure ip pim use-source is applied to the loopback before other unnumbered interfaces are enabled for PIM. |
3.7.13-3.7.16, 4.2.1-4.4.5 | |
| 2554588 |
If you try to reconfigure a DHCP server after you delete the switch configuration with the net del all command, the dhcpd service fails because a duplicate process is runningTo work around this issue, edit the /usr/lib/python2.7/dist-packages/nclu/plugins/dhcp.py file to change:DHCPD_PID="-pf {0}” to:DHCPD_PID="-pf {1}" |
3.7.13-4.2.1 | 4.3.0-4.4.5 |
| 2554369 |
Certain Dell S4048-ON switches show an incorrect vendor name and hang when you issue the reboot command. |
3.7.12-4.2.1 | 4.3.0-4.4.5 |
| 2554329 |
On the Dell N3248PXE switch, fixed RJ45 interfaces with PoE neighbors can end up in Paused mode after a switchd restart, which blocks traffic on that interface. |
3.7.12-3.7.16 | |
| 2553887 |
When using TACACS+ configured with a DEFAULT user providing privilege level lower than 16, TACACS+ configured users with privilege level 16 access might not be able to run privilege level 16 NCLU commands, such as net add and net del and see an error similar to the following:
To work around this issue, remove the DEFAULT user from the TACACS+ server. |
3.7.7-3.7.16, 4.0.0-4.4.5 | |
| 2553677 |
When you configure an SNMPv3 user with the net-snmp-config configuration command from the libsnmp-dev package, you get an error message similar to the one below:
To work around this issue, use the NCLU command to configure SNMPv3 user parameters; for example:
Alternatively, directly edit the /etc/snmp/snmpd.conf file as described in the documentation. |
3.7.13-3.7.16, 4.0.0-4.4.5 | |
| 2553219 |
You cannot configure SNMPv3 trap-destinations in non-default VRFs with an authentication username that contains fewer than eight characters. | 3.7.12-4.2.1 | 4.3.0-4.4.5 |
| 2553116 |
When you manually set the link speed or duplex mode with ethtool to an unsupported value, then run a TDR check against the interface, you encounter a switchd service heartbeat failure.To work around this issue, reboot the switch to clear the condition. Avoid setting the interface speed or duplex mode directly with ethtool. |
3.7.12-3.7.16, 4.0.0-4.4.5 | |
| 2553050 |
SNMP status might incorrectly reflect that a BGP neighbor is down due to an issue between bgpd and SNMP AgentX when the IP-FORWARD-MIB is also polled.To work around this issue, avoid polling IP-FORWARD-MIB objects. |
3.7.12-3.7.16 | |
| 2553015 |
If a neighbour contains a special character in PortID for LLDP, the net show interface command does not display the LLDP information or the command might fail. |
3.7.10-3.7.16, 4.2.0-4.4.5 | |
| 2552939 |
RX_DRP on a bond interface increases without any data traffic while the slave port does not increase. | 3.7.12-4.2.1 | 4.3.0-4.4.5 |
| 2552869 |
On the Dell N3048EP switch, the module information from SFP ports is not displayed in the l1-show command.To work around this issue, use the ethtool -m command. |
3.7.13-4.2.1 | 4.3.0-4.4.5 |
| 2552742 |
On the Mellanox SN2410 switch, you see switchd core and GBIN_MALLOC errors.To work around this issue, restart switchd. |
3.7.12-4.2.1 | 4.3.0-4.4.5 |
| 2552739 |
Counters for IPROUTER rules do not increase when traffic is forwarded to the CPU because there is no IP neighbor. | 3.7.2-3.7.16 | |
| 2552294 |
NCLU restarts FRR when removing a BGP VRF IPv4 aggregate-address command. |
3.7.12-3.7.16, 4.0.0-4.4.5 | |
| 2551911 |
ifupdown2 does not account for link status or link down configuration when running dhclient. For example, ifupdown2 ignores link-down yes during ifup/ifreload and runs the DHCP module if inet dhcp is configured on the interface. ifupdown2 also runs the DHCP module even when the physical link configured for DHCP is down. |
3.7.12-4.2.0 | 4.2.1-4.4.5 |
| 2551578 |
When you configure a bridge in the /etc/network/interfaces file, then try to reconfigure the bridge to be a VRF interface with the same name, ifreload/ifup commands fail with an invalid table id or unable to get vrf table id error. |
3.7.12-3.7.16, 4.0.0-4.4.5 | |
| 2551565 |
If you toggle VRRP priority values between VRRP routers, then restart switchd, a few IPv6 VRRP instances might not converge. As a result, both the VRRP routers act as master routers for the impacted IPv6 VRRP instances. IPv4 VRRP instances are not affectedTo work around this issue, remove, then add back the VRRP configuration with NCLU or vtysh commands. |
3.7.13-3.7.16, 4.2.0-4.4.5 | |
| 2551305 |
The net show configuration command provides the wrong net add command for ACL under the VLAN interface. |
3.7.12-3.7.16, 4.1.0-4.4.5 | |
| 2551288 |
When you remove BFD configuration by editing the /etc/frr/frr.conf file and restarting FRR, you see a traceback.To work around this issue, either use NCLU or vtysh commands to remove the BFD configuration, or restart FRR with the new /etc/frr/frr.conf file. |
3.7.7-3.7.16 | 4.0.0-4.4.5 |
| 2550974 |
On the Dell S3000 switch, after installing the Cumulus Linux 4.1.1 disk image without a license, the switch sends a link beat if a remote host port is configured. | 3.7.11-3.7.16, 4.1.1-4.4.5 | |
| 2550942 |
NCLU tab completion for net show displays the text add help text instead of system Information for the system option. |
3.7.11-4.2.0 | 4.2.1-4.4.5 |
| 2550796 |
On a Broadcom switch with the Trident2+ ASIC, ACL rules for VLANs are not applied after a reboot and the counters remain at zero. To work around this issue, either do not set acl.non_atomic_update_mode = TRUE in the /etc/cumulus/switchd.conf file or run the cl-acltool -i command after the reboot to install the ACLs. |
3.7.12-4.2.1 | 4.3.0-4.4.5 |
| 2550793 |
The NCLU net show bridge spanning-tree command displays the aging timer incorrectly. |
3.7.12-3.7.16, 4.0.0-4.4.5 | |
| 2550478 |
VXLAN interface as in-interface or out-interface in an ACL is not supported in Spectrum-based switches. | 3.7.7-4.2.0 | 4.2.1-4.4.5, 4.3.0-4.4.5 |
| 2550444 |
Tab completion for the net show rollback description command returns information about a snapshot instead of context help.To work around this issue, run the net show commit history command to find descriptions instead of the net show rollback description command. |
3.7.12-3.7.16, 4.0.0-4.4.5 | |
| 2550443 |
The net show rollback description command returns an error even if the string matches a commit description.To work around this issue, look for your string in the output of the net show commit history command (or grep for it there) instead. |
3.7.12-3.7.16, 4.0.0-4.4.5 | |
| 2550276 |
In LLDP, the snmp subagent loses all subsequent lldpRemSysName (1.0.8802.1.1.2.1.4.1.1.9) entries after an entry with a missing SysName is added.All the information from lldpctl is correct. Only the entries after the entry that is missing a SysName in lldpRemSysName disappear from the snmp subagent. |
3.7.12-4.2.1 | 4.3.0-4.4.5 |
| 2550243 |
When you use nginx and restserver in management VRF to provide a REST API for the switch, nginx starts but restserver fails to start.To work around this issue, comment out the Requires= line in the /lib/systemd/system/restserver.service. For example:
|
3.7.12-3.7.16, 4.0.0-4.4.5 | |
| 2550056 |
The ACCTON-DIAG option under the Cumulus Linux GRUB menu does not work. When you select this option, you see the following error:
|
3.7.12-3.7.16, 4.1.1-4.4.5 | |
| 2549925 |
When you run an Ansible script to replace the /etc/network/interfaces file, then run the ifreload -a command, you see errors similar to the following:
To work around this issue, run the ifreload -a command a second time. |
3.7.12-3.7.16, 4.0.0-4.4.5 | |
| 2549872 |
If you have an SVI with multiple VRR IP addresses and try to delete one of the VRR configurations, net commit or ifreload -a returns an error. |
3.7.12-3.7.16, 4.1.1-4.4.5 | |
| 2549838 |
In vtysh, if you configure, then remove a layer 3 VNI for a VRF, the VNI is removed from zebra even if the VNI interface still exists in the kernel. If you configure a layer 2 VNI as a layer 3 VNI by mistake, removing the layer 3 VNI binding removes it from zebra but EVPN-learned MACs and neighbors are not installed into the kernel. To work around this issue, delete, then re-add the missing VNI. For example:
If you flap the link with the ip link set vni10100 down; ip link set vni10100 up commands, zebra does not re-add the VNI. |
3.7.12-4.2.1 | 4.3.0-4.4.5 |
| 2549782 |
The JSON format output of the net show bgp l2vpn evpn summary command shows the incorrect neighbour state. |
3.7.12-3.7.16, 4.0.0-4.4.5 | |
| 2549731 |
When you create SPAN or ERSPAN rules in ebtables, the action fails to install if it is not in lowercase. Make sure that the SPAN or ERSPAN action is all lowercase; for example:
|
3.7.12-3.7.16, 4.1.1-4.4.5 | |
| 2549472 |
On switches with the Trident3 ASIC, PFC is not working as expected. If you set the PFC for only one CoS, pause frames are sent for all CoS traffic. | 3.7.11-4.1.1 | 4.2.0-4.4.5 |
| 2549371 |
When Optimized Multicast Flooding (OMF) is enabled with the bridge.optimized_mcast_flood = TRUE setting in the /etc/cumulus/switchd.conf file, the switch continues to flood IPv6 multicast traffic to all slave ports when there is no MLD join receive. |
3.7.11-4.3.3 | 4.4.0-4.4.5 |
| 2548962 |
With FRR or OSPF, you might see an inconsistent link-state advertisement. For example, when you configure the OSPF default originate route as metric-type 1 with a specific metric, Cumulus Linux shows the default originate route as an external metric-type 2 route with the default metric in the database. This issue typically occurs when both IPv4 and IPv6 default routes exist in the routing table. | 3.7.12-4.1.1 | 4.2.0-4.4.5 |
| 2548930 |
On Mellanox Spectrum switches that contain an OSPF IP unnumbered neighborship with a high scale of prefixes being learned, a link flap might cause the neighbor entry to not be programmed in hardware. | 3.7.11-4.2.1 | 4.3.0-4.4.5 |
| 2548746 |
On the Broadcom switch with the Trident3 ASIC, packet priority remark values assigned from each internal CoS value continue to work with default values; if you change the internal CoS value, the change does not take effect. | 3.7.11-4.1.1 | 4.2.0-4.4.5 |
| 2548657 |
When you upgrade Cumulus Linux on the EdgeCore AS7726-32X or AS7326-56X switch, you might see firmware errors similar to the following:
You can safely ignore these error messages. |
3.7.12-3.7.16, 4.0.0-4.4.5 | |
| 2548490 |
A change in a route map prefix list that should remove a route might not be reflected in the ospf6 database or in peers, and the route might not be deleted. To work around this issue, reenter the redistribute <connected|static> route-map statement in the configuration. |
3.7.11-4.1.1 | 4.2.0-4.4.5 |
| 2548485 |
If you configure the aggregate-address summary-only option before injecting a component of the same aggregate into the BGP table with the network or redistribute command, when you remove the aggregate-address configuration, the component stays suppressed; it is not advertised to peers. For example:Existing configuration:router bgp 1If you add network 50.0.0.1/32, you see the following (expected) BGP table entries:Status codes: s suppressed, d damped, h history, * valid, > best, = multipath,Removing aggregate-address 50.0.0.0/8 summary-only at this point results in the following (unexpected) BGP table entry:Status codes: s suppressed, d damped, h history, * valid, > best, = multipath,To work around this issue, remove, then re-add the component prefix routes. |
3.7.12-4.2.1 | 4.3.0-4.4.5 |
| 2548243 |
On switches with the Trident2+ ASIC, adding SPAN rules disables PBR rules. | 3.7.3-3.7.16, 4.0.0-4.4.5 | |
| 2548155 |
The net show bgp neighbor swpX json command shows negative output for the bgpTimerUpMsec timer. |
3.7.10-3.7.16 | 4.0.0-4.4.5 |
| 2548117 |
In OVSDB traditional bridge mode, adding or removing a VLAN binding causes a traffic forwarding outage for around 20 seconds or more on adjacent VLAN bindings. Cumulus Linux does not support traditional bridge mode with VMware NSX. | 3.7.12-3.7.16, 4.0.0-4.4.5 | |
| 2548044 |
When a remote VTEP withdraws a type-3 EVPN route, Cumulus Linux purges all MAC address and neighbor entries installed in the corresponding layer 2 VNI through that remote VTEP from the local EVPN and kernel forwarding tables. This purge occurs even if the remote VTEP does not withdraw type-2 routes carrying the MAC address or neighbor entries. The entries stay missing from the local EVPN and kernel forwarding tables until BGP updates the MAC address and neighbor. | 3.7.12-3.7.15, 4.0.0-4.4.5 | 3.7.16 |
| 2548024 |
On the Dell Z9100 switch, 100G-SR4 modules might not link up reliably in certain ports. swp1, 2, 3, 9, 10, 23, 24, 30, 31, and 32 might be affected To work around this issue, move 100G SR4 modules to one of the ports not affected by this issue. |
3.7.11-4.1.1 | 4.2.0-4.4.5 |
| 2547942 |
On the Lenovo NE0152T switch, one power supply (PSU2) always show as ABSENT in smonctl. | 3.7.11-4.0.1 | 4.1.0-4.4.5 |
| 2547839 |
When you try to configure link-down on a parent interface of a subinterface configured in a VRF, you encounter an error. |
3.7.11-4.1.1 | 4.2.0-4.4.5 |
| 2547782 |
If a LLDP neighbor advertises a PortDescr that contains commas, ptmctl -d splits the string on the commas and misplaces its components in other columns. |
3.7.11-3.7.16, 4.0.0-4.4.5 | |
| 2547706 |
When you configure ganged ports in the ports.conf file, the change does not take effect after you restart switchd. To work around this issue, reboot the switch. |
3.7.11-3.7.16, 4.0.0-4.4.5 | |
| 2547659 |
On the EdgeCore AS7326-56X switch, the default fan speed, which is defined in the thermal specification, results in excessive fan noise. | 3.7.11-4.0.1 | 4.1.0-4.4.5 |
| 2547573 |
On Tomahawk switches, when the vxlan_tnl_arp_punt_disable option is set to FALSE, ARP packets are not forwarded to the CPU. |
3.7.9-3.7.16 | |
| 2547443 |
On the Dell N3248PXE-ON switch, 25G SFP ports do not work in 10G mode. | 3.7.11-4.0.1 | 4.1.0-4.4.5 |
| 2547381 |
The hsflowd service sends an undefined header protocol 0 in the sampled flow sample to the collector, which is not recognized by the sFlow tool. You see errors similar to the following:
|
3.7.11-3.7.16 | 4.0.0-4.4.5 |
| 2547349 |
When you change an interface IP address, then change it back, static routes are misprogrammed One of the following actions recovers the routes:- Bounce both layer 3 interfaces- Remove or add static routes in FRR- Restart FRR |
3.7.11-3.7.16 | 4.0.0-4.4.5 |
| 2547123 |
On the Broadcom switch with the Trident3 ASC, packet priority remark values assigned from each internal CoS value continue to work with default values; if you change the internal CoS value, the change does not take effect. | 3.7.11-4.1.1 | 4.2.0-4.4.5 |
| 2547120 |
After you hot swap a PSU, the decode-syseeprom -t psuX command shows the old PSU information (such as the serial number), until you run the decode-syseeprom –init command. |
3.7.11-3.7.16, 4.0.0-4.4.5 | |
| 2547100 |
On switches with the Trident3 ASIC, PFC is not working as expected. If you set the PFC for only one CoS, pause frames are sent for all CoS traffic. | 3.7.11-4.1.1 | 4.2.0-4.4.5 |
| 2547068 |
Hardware platforms using the Intel D-1500 CPU series might reboot unexpectedly To work around this issue, contact your hardware vendor to inquire if a new version of BIOS with a microcode fix is available or manually disable CPU C-states in the kernel as outlined below To permanently disable C-states using a kernel boot parameter:1. Edit /etc/default/grub to add the argument processor.max_cstate=0 to the variable GRUB_CMDLINE_LINUX. For example, if /etc/default/grub file contains the line GRUB_CMDLINE_LINUX=“cl_platform=accton_as7726_32x console=tty0 console=ttyS0,115200n8 intel_iommu=off pcie_aspm=off”, change it to GRUB_CMDLINE_LINUX=“cl_platform=accton_as7726_32x console=tty0 console=ttyS0,115200n8 intel_iommu=off pcie_aspm=off processor.max_cstate=0”2. Run sudo update-grub3. Reboot the system with sudo rebootTo disable cstates in realtime on the current system, which does not persist through a reboot:1. Confirm that the libpci3 package is installed. Run dpkg-query -l libpci3 and confirm the following line is displayed:ii libpci3:amd64 1:3.2.1-3 amd64 Linux PCI Utilities (shared library)The first field above should read ii. If not, install the libpci3 package by running sudo apt upgrade;sudo apt install libpci32. Disable C-states by running the command ./cpupower idle-set -d 2C-states are disabled by default in Cumulus Linux 4.3.0 and later. |
3.7.9-4.2.1 | 4.3.0-4.4.5 |
| 2546991 |
The FRR service does not provide a way for automation to know if the configuration applied properly. To work around this issue, execute the vtysh -f command in the automation file before starting the FRR service to validate the functional configuration and return an error code. |
3.7.11-3.7.16, 4.0.0-4.4.5 | |
| 2546895 |
If you have configured a higher number of ports and VLANs (ports x VLANs) or the switch is a lower-powered (CPU) platform, the switchd service might fail to send a systemd keepalive within the watchdog timeout value (2 minutes by default) and you see an error similar to the following:bq. systemd[1]: switchd.service watchdog timeout (limit 2min)!To workaround this issue, either reduce the number of configured interfaces and, or VLANs, or increase the systemd timeout for switchd.serviceTo increase the systemd timeout:1.Edit the /etc/systemd/system/switchd.service.d/override.conf file and increase the WatchdogSec parameter2.Restart the switchd service with the sudo systemctl restart switchd.service commandsystemd attempts to restart the switchd service automatically (after the watchdog timeout). If the restart fails multiple times in a short time period, run the sudo systemctl reset-failed command followed by the sudo systemctl restart switchd command. |
3.7.11-3.7.16, 4.0.0-4.4.5 | |
| 2546450 |
On the EdgeCore AS7326-56X switch, you might see the RPM of certain fans run over the maximum threshold. | 3.7.11-3.7.16 | |
| 2546385 |
SNMP ifLastChange reports link transitions when there are none. | 3.7.6-3.7.16 | |
| 2546225 |
When you execute the following command on the Delta AG6248C switch, the switch reboots and then comes right back into Cumulus Linux without installing the new image. The install image is still in /var/lib/cumulus/installer, which causes issues with cl-support.
To work around this issue, use the onie-select command to access ONIE, and then use the nos-install command in ONIE to install a new binary image. |
3.7.11-3.7.16, 4.0.0-4.4.5 | |
| 2546203 |
When using QinQ with a traditional bridge, if you enable the LLDP dot1 TLV option, you see the following suboptimal behavior: * Both the inner and outer VLAN information is sent as part of VLAN TLVs in the LLDP packet. * If the outer VLAN ID is the same as the inner VLAN ID, only one VLAN TLV is sent with that VLAN ID in the LLDP packet. |
3.7.11-3.7.16 | |
| 2546131 |
On the Delta AG-6248C PoE switch, when you run the apt upgrade command, the upgrade does not work. Cumulus Linux uses uboot directly instead of grub to boot the kernel. Uboot needs a special header to boot the kernel, which is not present. Without this header, when you use the apt upgrade command to upgrade Linux packages, uboot is unable to boot up the kernel. To work around this issue, upgrade Cumulus Linux by installing the Cumulus Linux image. Run the onie-select command to go into ONIE, and then use the nos-install command in ONIE to install a new image.This workaround only works when an out-of-band network is present. |
3.7.11-3.7.16, 4.0.0-4.4.5 | |
| 2546010 |
When hal.bcm.per_vlan_router_mac_lookup is set to TRUE in the /etc/cumulus/switchd.conf file, inter-VLAN traffic is forwarded to the CPU when associated VNI interfaces exist. |
3.7.10-3.7.16 | |
| 2545997 |
The NCLU command net show interface produces an error if bonds with no members exist.To work around this issue, remove the empty Bond interfaces from the /etc/network/interfaces file and run sudo ifreload -a. |
3.7.10-3.7.16 | |
| 2545566 |
The Dell Z9100-ON switch incorrectly reports many sensors as ABSENT. | 3.7.12-4.0.1 | 4.1.0-4.4.5 |
| 2545446 |
If you use NCLU commands to add a non-MLAG bond, then add an MLAG configuration, the net commit command fails. However, a subsequent net commit command succeeds. |
3.7.10-3.7.16 | |
| 2545125 |
If you configure more than one VRR interface on an SVI interface, deleting one of the VRR addresses does not remove the interface/address. | 3.7.10-3.7.16, 4.0.0-4.4.5 | |
| 2544978 |
If you delete an undefined bond, then add a bond slave, the net commit command fails. |
3.7.9-3.7.16, 4.0.0-4.4.5 | |
| 2544968 |
FRR configuration commands for an SVI interface might have the \n misplaced in the output. For example:
should be:
To work around this issue, configure the interface manually in the /etc/frr/frr.conf file. |
3.7.9-3.7.16, 4.0.0-4.4.5 | |
| 2544953 |
When you update the hostname of a switch with the NCLU net add hostname command, then run net commit, the lldpd service does not restart and other devices still see the old hostname.To work around this issue, run the sudo systemctl restart lldpd.service command. |
3.7.10-3.7.16, 4.0.0-4.4.5 | |
| 2544904 |
After you delete an IPv6 numbered BGP peer group neighbor, Cumulus Linux might continue to send route advertisements. To work around this issue, restart FRR after removing the IPv6 numbered configuration. |
3.7.9-4.1.1 | 4.2.0-4.4.5 |
| 2544829 |
Frames received with a VLAN tag of 0 on an interface configured as a bridge port and forwarded to the CPU for processing might appear tagged with the native VLAN when viewed with tcpdump. |
3.7.8-3.7.16 | |
| 2544556 |
If you reconfigure an NTP server with NCLU using different trailing options after the IP address (such as iburst), an invalid configuration is added to the /etc/ntp.conf file. For example:
If you need to alter existing server configurations, first remove the server, commit, then re-add the server with any trailing options. |
3.7.9-4.1.1 | 4.2.0-4.4.5 |
| 2544463 |
Auto-negotiation does not work with the QSFP28 cables and a remote system operating at 10G. Attempting to enable auto-negotiation with ethtool -s swp<#> autoneg on returns Operation not supported.To work around this issue, do not use auto-negotiation and set the local port speed to 10G. |
3.7.9-3.7.16, 4.0.0-4.4.5 | |
| 2544456 |
The NCLU net show lldp command displays the speed of a ganged port group as the speed of one of the individual links, rather than the sum of their speeds. |
3.7.9-3.7.16, 4.0.0-4.4.5 | |
| 2544311 |
Applying a policy-based routing (PBR) rule for all traffic from a host might disrupt ARP refresh for that connected host. | 3.7.5-3.7.16, 4.0.0-4.4.5 | |
| 2544155 |
NCLU requires you to specify an interface with multiple address-virtual statements in ascending MAC address order. |
3.7.5-3.7.16, 4.0.0-4.4.5 | |
| 2544113 |
Mac learning is not disabled by default on a double tagged peer link interface resulting in the MAC address changing between the MLAG bond and the peer link. To work around this issue, disable MAC learning on QinQ VLANs by adding bridge-learning off to the VLAN stanza in the etc/network/interfaces file. |
3.7.9-3.7.16, 4.0.0-4.4.5 | |
| 2543900 |
On the Mellanox switch, static VXLAN tunnels incorrectly allow traffic from any remote tunnel IP address. | 3.7.8-3.7.16, 4.0.0-4.4.5 | |
| 2543841 |
The net show evpn vni detail json command includes an extra empty dictionary at the end of the output. |
3.7.8-3.7.16, 4.0.0-4.4.5 | |
| 2543840 |
On the Mellanox SN2700 switch, you cannot enable resilient hashing (RASH) and set the bucket size to 64 in the traffic.conf file. |
3.7.6-3.7.16 | |
| 2543800 |
When local-tunnelip is an SVI, the static VXLAN tunnel does not work; the next hop router receives the packet but drops it as it does not know where to forward the packet. The static VXLAN tunnel does works if local-tunnelip is a loopback or a physical layer 3 interface. |
3.7.8-3.7.16 | 4.0.0-4.4.5 |
| 2543647 |
ERSPAN in ebtables does not work for VNIs. For example, the following rule does not work:
|
3.7.6-4.2.1 | 4.3.0-4.4.5 |
| 2543646 |
In an ebtables rule, ERSPAN (upper case) does not work. You need to specify erspan (lower case). | 3.7.6-3.7.16, 4.0.0-4.4.5 | |
| 2543627 |
Tomahawk 40G DACs cannot disable auto-negotiation. | 3.7.7-3.7.16 | 4.0.0-4.4.5 |
| 2543270 |
The default route injected through OSPF when you configure default-information originate always is unreliable and might age out unexpectedly.To work around this issue, rely on a different source of default route other than injection with default-information originate. |
3.7.8-4.1.1 | 4.2.0-4.4.5 |
| 2543211 |
In some cases, the switchd service might warn of excessive MAC moves from one switch port to itself (for example, from swp18 to swp18). |
3.7.0-3.7.16, 4.0.0-4.4.5 | |
| 2543164 |
The MTU of an SVI cannot be higher than the MTU on the bridge. Changing the MTU on the SVI with NCLU does not update the bridge MTU. The net commit command succeeds even though the MTU is not changed as expected.To work around this issue, change the MTU on all SVIs and the bridge manually in the /etc/network/interfaces file, then apply the change with the ifreload -a command. |
3.7.7-3.7.16, 4.0.0-4.4.5 | |
| 2543096 |
When an SVI with a virtual MAC is configured with a layer 2 VNI in an EVPN environment, if you replace the /etc/network/interfaces file with a different file that does not have the SVI and layer 2 VNI configuration, the original virtual MAC is not populated through the EVPN route until FRR is restarted. |
3.7.6-3.7.16, 4.0.0-4.4.5 | |
| 2543058 |
The IP neighbor entry for a link-local next hop is not installed by FRR, which results in a forwarding failure for routes via that next hop. This is a rare problem that occurs with IPv4 route exchange over IPv6 GUA peering with no IPv4 addresses on the interfaces. To work around this issue, flap the peering to the peer router (which might be a route reflector) to recover. To avoid this issue, configure IPv6 router advertisements on the connecting interfaces. |
3.7.7-3.7.16 | 4.0.0-4.4.5 |
| 2543052 |
Received EVPN type-5 and type-2 MACIP routes are not installed in the kernel (and hardware) routing tables for the associated VRF, which causes traffic to be blackholed. The failure to install the default route causes complete reachability failure for the particular tenant on the affected racks. The routes that are not installed are seen as “inactive” in the routing subsystem (FRR) VRF routing table. This problem is rare and can occur only in EVPN configurations that have user-configured route targets (RTs) for tenant VRFs, and only following a restart of FRR. To work around this issue, either restart the FRR service on the affected switch with the sudo systemctl restart frr.service command or bounce the layer 3 SVI for the affected VRF; for example:
You can run the net show vrf vni command to print a mapping of VRF : L3-VNI : L3-SVI. |
3.7.5-3.7.16 | 4.0.0-4.4.5 |
| 2543044 |
Under certain conditions, EVPN next hops might not be removed when the contributing peer goes down or might not be populated when the BGP session to the contributing peer comes up. You can prevent EVPN next hops from not being removed when the contributing peer goes down by specifying static MAC addresses on all layer 3 VNIs. There is no workaround for preventing EVPN next hops from not being populated when the BGP session to the contributing peer comes up. |
3.7.2-3.7.16 | 4.0.0-4.4.5 |
| 2542979 |
On the Dell-N3048EP-ON switch, when you run the sudo -E apt upgrade command, the upgrade does not work. |
3.7.7-4.1.1 | 4.2.0-4.4.5 |
| 2542945 |
On the Broadcom Maverick switch with a QinQ configuration, the packets coming into the CPU might be tagged incorrectly; for example, 802.1ad + 802.1q tags are expected in the packets but the packets have 802.1q + 802.1q tags. To work around this issue, configure the bridge with bridge-vlan-protocol 802.1ad:
|
3.7.6-3.7.16, 4.0.0-4.4.5 | |
| 2542310 |
hsflow disregards the setting for agent.cidr in the /etc/hsflowd.conf file and selects an IPv6 agent address. The source IP address of the hsflowd packet is IPv4, but the agent address in the hsflow payload shows IPv6. |
3.7.6-3.7.16 | |
| 2542305 |
If an SVI exists in the configuration before you assign it an IP address, when you do assign the IP address with the NCLU command, the vlan-id and the raw-device bridge stanzas are not added automatically. |
3.7.6-3.7.16, 4.0.0-4.4.5 | |
| 2542301 |
When first creating a bond and enslaving an interface, NCLU hides some of the bridge command suggestions, although they are still accepted. |
3.7.3-3.7.16, 4.0.0-4.4.5 | |
| 2541212 |
The maximum-prefix configuration under the IPv4 address family has an optional restart value, which you can configure. This configuration is ignored and, instead of restarting the sessions every x minutes, the peer constantly changes between established and idle due to the prefix count being exceeded. |
3.7.5-3.7.16, 4.0.0-4.4.5 | |
| 2541165 |
On the Dell N3048EP-ON switch, UPOE is supported only on ports 1 thru 12. (UPOE uses all four pairs of standard Ethernet cabling whereas PoE delivers power over two twisted pairs.) When you plug a UPOE device in a port higher than port 12, poectl reports that four_pair_mode_enabled is true. However, this configuration is not supported on the port so poectl should report that four_pair_mode_enabled is false. |
3.7.6-3.7.16 | |
| 2541029 |
On switches with the Trident2 ASIC, 802.1Q-encapsulated control plane traffic received on an interface with 802.1AD configured subinterfaces might be dropped. This issue only affects QinQ configurations. |
3.7.5-3.7.16, 4.0.0-4.4.5 | |
| 2540950 |
On the QuantaMesh T4048-IX8 or EdgeCore AS7326-56X switch, when using a 1000BASE-T SFP module, the module LEDs do not light to reflect link status. |
3.7.3-4.1.1 | 4.2.0-4.4.5 |
| 2540885 |
The Dell N3048EP-ON switch does not support 1G Base-T modules in the SFP ports. | 3.7.7-3.7.16 | |
| 2540863 |
On the EdgeCore AS5812-54X switch, the PSU2 Fan1 fluctuates between OK and LOW. When the fan speed is reported as LOW, the RPM is shown as a negative number. |
3.7.3-3.7.16 | |
| 2540753 |
If the interface alias contains a single or double quotation mark, or an apostrophe, the net show configuration commands fail with the following error:
|
3.7.5-3.7.16, 4.0.0-4.4.5 | |
| 2540444 |
SNMP incorrectly requires engine ID specification. |
3.7.4-3.7.16, 4.0.0-4.4.5 | |
| 2540352 |
When you use NCLU to configure a route map, the parser allows for glob matching of interfaces for a match interface condition when there can only be a single interface matched. The proper syntax is to use multiple route map clauses, each matching a single interface, instead of a single clause matching multiple interfaces. For example, this command is incorrect:
These commands are correct:
|
3.7.2-3.7.16, 4.0.0-4.4.5 | |
| 2540340 |
NCLU allows for the configuration of addresses on VRF interfaces, but tab completion for the net add vrf command just displays
Tab completion for the net add vrf command works correctly. |
3.7.4-3.7.16, 4.0.0-4.4.5 | |
| 2540274 |
On the Maverick switch, CPU forwarded packets might be dropped when there is no route to a leaked host route. | 3.7.5-3.7.16, 4.0.0-4.4.5 | |
| 2540204 |
When links come up after FRR is started, VRF connected routes do not get redistributed. | 3.7.4-3.7.16, 4.0.0-4.4.5 | |
| 2540192 |
The net del bridge bridge mcsnoop yes command does not return the value to the default of disabled. To work around this issue, use the net add bridge bridge mcsnoop no command to delete the mcsnoop attribute and return to the default value. |
3.7.4-3.7.16, 4.0.0-4.4.5 | |
| 2540155 |
On the Broadcom switch, when moving configuration from bridged to routed (or toggling from routed to bridged to routed), some traffic is not seen by the kernel. This can cause BGP to not establish on a transit node. |
3.7.3-3.7.16, 4.0.0-4.4.5 | |
| 2540042 |
When you try to configure the VRRP priority and advertisement-interval with NCLU on a traditional mode bridge, the net commit command fails. To work around this issue, use the vtysh command (inside FRR) to change the VRRP priority or advertisement-interval on traditional bridges. For example:
|
3.7.4-3.7.16, 4.0.0-4.4.5 | |
| 2540041 |
On SVIs in a VLAN-aware bridge, you cannot change the VRRP priority with NCLU. To work around this issue, run the vtysh command inside FRR to change the default priority. For example:
|
3.7.4-3.7.16, 4.0.0-4.4.5 | |
| 2540040 |
Cumulus Linux uses VRRPv3 as the default version, and enables both preempt and accept mode by default. You cannot change these default values with NCLU. To work around this issue, run the vtysh commands (inside FRR) to change the default values. For example:
|
3.7.4-3.7.16, 4.0.0-4.4.5 | |
| 2540031 |
NCLU does not honor auto all in the /etc/network/interfaces file and removes the existing configuration if no individual auto lines exist. |
3.7.3-3.7.16, 4.0.0-4.4.5 | |
| 2539994 |
When you try to remove a BGP peer group configuration with NCLU, the command fails but no warning message is shown. For example:
|
3.7.2-3.7.16, 4.0.0-4.4.5 | |
| 2539962 |
When an LDAP user that does not have NCLU privileges (either in the netshow or netedit group, or in the /etc/netd.conf file) runs an NCLU command, a traceback occurs instead of a permissions error. |
3.7.0-3.7.16, 4.0.0-4.4.5 | |
| 2539670 |
On the Edgecore 4610-54P switch, automatic medium-dependent interface crossover (auto-MDIX) stops working on a 100M full duplex interface and does not detect the required cable connection type. |
3.7.2-3.7.16, 4.0.0-4.4.5 | |
| 2539124 |
The net add interface command adds no ptm-enable for that interface in the frr.conf file. Running the net add or the net del command does not remove no ptm-enable from the frr.conf file. You have to remove it manually using vtysh. |
3.7.2-3.7.16, 4.0.0-4.4.5 | |
| 2539081 |
When you delete post-up and pre-down IP peer entries from the etc/network/interfaces file, then run the ifreload command, the IP addresses are not removed and the route remains in the route table. To work around this issue, either delete the IP addresses without the /32 mask component or flush the IP addresses for the interface with the ip addr flush dev command. |
3.7.0-3.7.16 | 4.0.0-4.4.5 |
| 2538875 |
IPv6 multicast traffic destined to an unregistered multicast group is flooded to all ports in a bridge despite the bridge.optimized_mcast_flood = TRUE setting in the /etc/cumulus/swichd.conf file. |
3.7.2-3.7.16 | |
| 2538790 |
NCLU automatically adds the VLAN ID (for the layer 3 VNI/SVI) to the bridge when you run net add vxlan . This configuration breaks network connectivity in an EVPN symmetric routing configuration using MLAG. To restore connectivity, remove the VLAN ID from the bridge. |
3.7.2-3.7.16, 4.0.0-4.4.5 | |
| 2538590 |
When you configure a control plane ACL to define permit and deny rules destined to the local switch, NCLU programs the control plane ACL rules into the FORWARD chain. |
3.7.2-3.7.16, 4.0.0-4.4.5 | |
| 2538562 |
On an RMP/1G-T switch, when you remove link-speed 100 with the NCLU command or by editing the etc/network/interfaces file to revert the 100M interface to the default (1G auto), the interface fails to recover and does not come back up.After you remove the link-speed, ethtool shows the advertised link modes as not reported and Speed/Duplex as unknown.To work around this issue and bring the interface back up, either restart switchd or use ethtool to configure the speed, advertised, duplex or MDI-X settings. Note: The advertised link mode gets set incorrectly if you include 1000baseT/Half. The port will come up successfully at 1G. |
3.7.2-3.7.16, 4.0.0-4.4.5 | |
| 2538302 |
portwd allows an error to change the module type based on the error. For example, a bad write to a module might cause the module type to flap, which causes the link itself to flap. |
3.7.0-3.7.16 | |
| 2538294 |
If you use NCLU to create an iBGP peering across the peer link, running the net add bgp l2vpn evpn neighbor peerlink.4094 activate command creates a new eBGP neighborship when one has already been configured for iBGP. This is unexpected; the existing iBGP configuration is valid. |
3.7.0-3.7.16, 4.0.0-4.4.5 | |
| 2538256 |
On the Broadcom switch, when a link-local multicast frame is received on an access port with a VNI in the bridge, two copies of the packet are sent across the VNI to remote VTEPs and the receiving hosts observe duplicate packets. |
3.7.2-4.0.1 | 4.1.0-4.4.5 |
| 2537819 |
When you enable FEC (RS or BaseR) on an interface, removing the configuration from that interface does not revert the FEC status to off/none. |
3.7.2-3.7.16 | 4.0.0-4.4.5 |
| 2537699 |
There is a limitation on the number of SVI interfaces you can specify as DHCP relay interfaces in the /etc/default/isc-dhcp-relay file. For example, 1500 SVI interfaces causes the dhcrelay service to exit without a core file and logs similar to the following are generated for the interfaces:
Eventually the dhcrelay service stops. |
3.7.1-3.7.16, 4.0.0-4.4.5 | |
| 2537544 |
When you run the mstpctl command, you might see the bridge-port state as blocking when it is actually disabled. You might see the same incorrect bridge-port state when other programs or tools use the output of mstpctl; for example, SNMP output from the BRIDGE-MIB. |
3.7.1-3.7.16, 4.0.0-4.4.5 | |
| 2537378 |
NCLU SNMPv3 user configuration (add, delete, modify) does not complete. Changes are made to the /etc/snmp/snmpd.conf file but the SNMPv3 user cache file /var/lib/snmp/snmpd.conf fails to update correctly and the configuration does not reflect in operation. To work around this issue, stop snmpd, remove the cache file, then restart snmpd. |
3.7.1-3.7.16 | |
| 2537188 |
When an event in the network, such as a switchd or networking service restart, leads to an OVSDB server high availability transition, an ovs-vtepd core might occur. This core generation has no effect on the functionality of high availability when the active OVSDB server is back in the network. |
3.7.2-3.7.16 | |
| 2537104 |
When you try to stop hsflowd on the Trident II+ switch with the systemctl stop hsflowd command, the process hangs until you stop it with SIGKILL. |
3.7.1-3.7.16 | 4.0.0-4.4.5 |
| 2537061 |
The Dell S5048F-ON switch (with reverse airflow, rear to front), shows the Temp-3 sensor as absent. |
3.7.1-4.0.1 | 4.1.0-4.4.5 |
| 2536608 |
Single tagged ARP requests received on a QinQ-over-VXLAN access port are dropped if ARP suppression is enabled on an unrelated VNI. |
3.7.0-3.7.16 | |
| 2536384 |
The BFD packet redirection logic used by OVSDB server high availability mode redirects BUM packets across the peer link. The iptables rule for redirection does differentiate between BFD and non-BFD VXLAN inner packets because the service node sends all frames with its own IP address as the tunnel source IP address. The VXLAN encapsulated BUM packets do not get forwarded to the CPU and do not go through the iptable redirection rule; only VXLAN encapsulated BFD packets get forwarded to the CPU due to the inner MAC DA lookup in hardware. |
3.7.0-3.7.16, 4.0.0-4.4.5 | |
| 2536179 |
On switches with the Trident 2+ ASIC, counters associated with VLANs and VRFs are not working. | 3.7.0-3.7.16, 4.0.0-4.4.5 | |
| 2535986 |
At a high CPU transmit traffic rate (for example, if there is unexpected CPU generated flooding or replication in software), when the ASIC packet driver cannot keep up with the transmit rate because there are no free DMA buffers, it can back pressure by suspending the switch port transmit queues. This can fill up the application socket buffers resulting in No buffer space available error messages on protocol sockets.When the driver recovers, it automatically resumes the transmit queues. In most cases these error messages are transient. In rare cases, the hardware queues might get stuck, which you can recover with a switchd restart. |
3.7.0-3.7.16, 4.0.0-4.4.5 | |
| 2535965 |
On the Trident3 switch, static PIM with IIF based on a layer 2 bridge does not work reliably. PIM Join via signaling is required for IPMC to work properly. To work around this issue, use dynamic signaling (joins) to manage IP multicast traffic. |
3.7.0-3.7.16, 4.0.0-4.4.5 | |
| 2533691 |
If you configure a VLAN under a VLAN-aware bridge and create a subinterface of the same VLAN on one of the bridge ports, the bridge and interface compete for the same VLAN and if the interface is flapped, it stops working. Correcting the configuration and running the ifreload command does not resolve the conflict. To work around this issue, correct the bridge VIDs and restart switchd or delete the subinterface. |
3.7.12-3.7.16, 4.0.0-4.4.5 | |
| 2532017 |
In FRR, bgp_snmp does not show all BGP peers when peer groups used. |
3.7.11-4.0.1 | 4.1.0-4.4.5 |
Fixed Issues in 3.7.15
| Issue ID | Description | Affects |
|---|---|---|
| 2599607 |
In some corner cases, remote MAC entries may be seen as locally learnt entries in FDB table due to switchd reprogramming it | 3.7.12-3.7.14.2 |
| 2595889 |
In a traditional bridge configuration with ip-forward off, neighbors are synchronized to hardware with a switchd restart but are cleared when you flap the bridge interface. |
3.7.10-3.7.14.2, 4.0.0-4.2.1 |
| 2595816 |
Tenant VRF BGP peers appear in the EVPN RMAC and nexthop tables, which causes the kernel RMAC to point at invalid IP address. | 3.7.12-3.7.14.2, 4.0.0-4.2.1 |
| 2589747 |
If switchd successfully signals clagd that it is going down, clagd stops responding to keepalive echo requests from the peer instead of sending a good bye to the peer over both the peerlink and the backup switch. Eventually, the keepalive timer expires and the secondary switch becomes the primary, and brings the bonds and VNIs back up. However, if switchd does not successfully signal it is going down, (in the event of a crash), the primary switch continues to respond to keepalives, and the bonds and VNIs are down on both peers. |
3.7.12-3.7.14.2, 4.0.0-4.2.1 |
| 2562511 |
hostapd does not fail over to secondary RADIUS servers for 802.1x authentication when the primary radius is reachable but not responding to Access-RequestsIf the primary RADIUS server is having a problem servicing requests, you can remove it from the configuration temporarily to force requests to be sent to alternate servers. |
3.7.10-3.7.14.2 |
| 2556815 |
When ARP suppression is enabled, RARP packets sometimes get dropped and are not flooded by the local VTEP. To work around this issue, disable ARP suppression. |
3.7.14-3.7.14.2, 4.3.0 |
| 2556763 |
In a configuration with both traditional and VLAN-aware bridges, the VLAN membership check on a VLAN-aware bridge does not drop PVST BPBUs that come from a traditional bridge. | 3.7.14-3.7.14.2, 4.0.0-4.3.0 |
| 2556233 |
Some ECMP next-hops might fail installation into hardware at high ECMP group and route scale. The following log message will be observed when this condition occurs:WARN xx routes reverted to non-ECMP due to NH table capacity |
3.7.9-3.7.14.2 |
| 2556023 |
After upgrading Cumulus Linux with the apt-upgrade command, then rebooting an MLAG pair, if there are no bonds configured with a clag-id, the clagd service has difficulty peering, and holds all MLAG interfaces and VNIs in a proto down stateTo work around this issue, after upgrading both switches, restart the clagd service with the sudo systemctl restart clagd command on each MLAG pair. |
3.7.14-3.7.14.2 |
| 2556011 |
On Broadcom switches, after repeated VLAN or VXLAN configuration changes, switchd memory might not free up appropriately, which can lead to a crash. |
3.7.14, 4.0.0-4.2.1 |
| 2555532 |
QinQ (802.1Q) packets routed to a layer 3 subinterface are still double tagged with the VLAN of the subinterface and the original inner VLAN when they leave the subinterface. | 4.2.0-4.2.1 |
| 2555401 |
On the Edgecore AS7312 switch, eth0 and swp use the same MAC address. | 3.7.14-3.7.14.2, 4.0.0-4.2.1 |
| 2555278 |
When you change the anycast address for the MLAG pair (clagd-vxlan-anycast-ip), high peak traffic occurs on the peer link interface of all MLAG switches. | 3.7.13-3.7.14.2 |
| 2555177 |
On Mellanox switches, the ASIC temperature sensor reading reports zeros. As a result, the fan speed is higher than normal. You can see the temperature reading in the output of the sensors command. |
3.7.14 |
| 2554991 |
When running traditional mode bridges at scale (for example, when you have more than 200 bridges and a large number of MAC addresses), MLAG bonds flap intermittently from dual to single connected, then back to dual connected, which causes a layer 2 loop and STP state changes. To work around this issue, either shut down one side of the MLAG bond or prune out VLANS over the bond. |
3.7.13-3.7.14.2, 4.0.0-4.2.1 |
| 2554804 |
On Mellanox SN2010 and SN2100 switches, the maximum fan speed is exceeded by fifteen percent. | 3.7.14-3.7.14.2 |
| 2554719 |
A slow memory leak is observed (1% per 14 hours) in kmalloc-256. To work around this issue, reboot the switch. |
3.7.12-3.7.14.2 |
| 2553748 |
On switches with the Spectrum ASIC, the IPv6 default route is present in the kernel but missing in hardware. | 3.7.11-3.7.14.2, 4.2.1 |
| 2552213 |
The Mellanox SN2700 and SN2410 switch intermittently reports PSU fan state changes with Unable to read from device/fan1_input/pwm1 syslog messages. |
3.7.11-3.7.14, 4.1.1-4.3.0 |
| 2550600 |
The received PVST BPDU for a VLAN is flooded even though the ingress port doesn’t have the VLAN tagged. | 3.7.8-3.7.14.2, 4.0.0-4.3.0 |
| 2549226 |
You might see the following gport error messages in switchd.log:
These messages are harmless and can be ignored. |
3.7.12-3.7.14.2, 4.0.0-4.2.1 |
3.7.14.2 Release Notes
Open Issues in 3.7.14.2
| Issue ID | Description | Affects | Fixed |
|---|---|---|---|
| 3410952 |
If MLAG is configured but disconnected from an MLAG peer for an extended period of time (days or more), there is a long delay (up to a minute per day) before traffic forwarding stabilizes after the MLAG peer connection re-establishes. | 3.7.0-4.3.1 | 4.3.2-4.4.5, 5.5.0-5.15.0 |
| 3376798 |
On Broadcom switches, Cumulus Linux does not create the hardware bridging domain for a traditional bridge with a VXLAN interface during switchd restart. The /var/log/switchd.log file includes the following exception logs shortly after switchd restarts:switchd[30158]: hal_bcm_l3.c:1617 find_egr_path_if_vxlan_overlay:vxlan overlay : nh PORT: port <#>, vlanMAC learning looks correct, but traffic does not flow as expected. |
3.7.0-4.3.1 | 4.3.2-4.4.5 |
| 3330705 |
When using TACACS+, a TACACS+ server name that returns more than one IP address, such as an IPv6 and IPv4 address, is counted many times against the limit of seven TACACS+ servers, which might cause some of the later listed servers to be ignored as over the limit. To work around this issue, you can set the prefer_ip_version configuration option (the default value is 4) to choose between an IPv4 or IPv6 address if both are present. |
3.7.0-5.3.1 | 5.4.0-5.15.0 |
| 3327477 |
If you use su to change to a user specified through TACACS+, the user becomes the local tacacs0 thru tacacs15 user instead of the named user to run sudo commands. As a result, the named user password might not match the local tacacs0 thru tacacs15 user password. |
3.7.0-3.7.16, 4.0.0-4.4.5, 5.0.0-5.15.0 | |
| 3216921 |
RADIUS authenticated users with read-only access to NCLU commands (users in the users_with_show list) can run edit commands if a username for a non-local account is on the users_with_edit line of the /etc/netd.conf file. To work around this issue, make sure that all usernames on the users_with_edit line of the /etc/netd.conf file are configured local users for the system (real Linux users) |
3.7.0-3.7.16, 4.3.0-4.4.5 | |
| 3209699 |
RADIUS authenticated users with read-only access to NCLU commands (users in the users_with_show list) can run edit commands if a username for a non-local account is on the users_with_edit line of the /etc/netd.conf file. To work around this issue, make sure that all usernames on the users_with_edit line of the /etc/netd.conf file are configured local users for the system (real Linux users) |
3.7.0-4.3.0, 4.4.0-5.2.1 | 4.3.1, 5.3.0-5.15.0 |
| 3135801 |
Zebra rejects MAC IP updates from BGP when the MAC mobility sequence number that BGP sends is lower than the sequence number known to zebra When the MAC mobility sequence that BGP knows legitimately lowers (due to narrow timing conditions during convergence or after rebooting an MLAG pair one VTEP at a time), zebra rejects these updates and maintains a stale state. If the stale information that zebra uses points to the wrong VTEP address, traffic goes to the wrong VTEP and might drop. |
3.7.12-4.3.0 | 4.3.1-4.4.5 |
| 3073668 |
On the EdgeCore AS4610 switch, when you change the speed of any of the SFP+ ports, the other SFP+ ports flap. | 3.7.12-3.7.16, 4.3.0-4.4.5 | |
| 3017190 |
When you power cycle the switch, multiple interfaces came up in a PoE disabled state To work around this issue, run the sudo poectl -a | grep disabled command to find ports with disabled POE. Run the sudo poectl -e swp1-swp48 command to enable POE on affected ports. |
3.7.10-3.7.16 | |
| 2959067 |
ECMP produces errors indicating No More Resources and switchd crashes even when ECMP utilization is low. |
3.7.14.2-4.2.1 | 4.3.0-4.4.5 |
| 2959024 |
ACL rules do not always install in hardware after switch reboot To work around this issue, run the sudo cl-acltool -i command to reinstall the ACL rules. |
3.7.14.2-3.7.15 | 3.7.16 |
| 2940076 |
In a VXLAN fabric with ToR switches configured in a MLAG pair, BUM traffic received on a VXLAN tunnel is decapsulated and forwarded on the peer link bond. The BUM traffic is then encapsulated by the peer switch and sent back to the fabric. The issue has been seen in environments where the following conditions exist at the same time:1) high VNI scale2) switchd is busy processing updates3) clagd is in a transition state, such as Up, then Down, then Up. For example, when clagd restarts, the switch reboots, and so onThe problem is seen on the switch that experiences the clagd state transition. |
3.7.12-3.7.15 | 3.7.16 |
| 2940063 |
Under certain high scale conditions, various modules might experience timetouts during cl-support collection, which results in missing data in the cl-support file. | 3.7.12-3.7.15, 4.1.1-4.3.0 | 3.7.16, 4.3.1-4.4.5, 5.0.0-5.15.0 |
| 2940051 |
In an MLAG configuration with traditional bridges, MAC addresses are seen over peer link during ifreload when adding new VLANS or bridges. |
3.7.14.2-3.7.15, 4.3.0-4.4.5 | 3.7.16, 5.0.0-5.15.0 |
| 2934940 |
When you change the SVI vlan-id value in the /etc/network/interfaces file, then run ifreload -a, the 802.1Q ID for the SVI in the kernel does not change.This operation is not supported in the kernel without recreating the SVI. To apply the change, run ifdown, then ifup for the SVI to recreate the interface. |
3.7.13-4.2.1 | 4.3.0-4.4.5 |
| 2934939 |
When you configure BGP aggregate-address summary-only and any component route within the summary updates, all component routes within the summary update in the RIB on the device advertising the summary. This condition might result in increased CPU usageTo workaround this issue, remove the aggregate-address summary-only configuration, add a static route to Null0 for the prefix, and configure an outbound route map to restrict anything more specific than the desired prefix from being advertised. For example: Before:address-family ipv4 unicastAfter: ip route 10.10.0.0/16 Null0This example assumes no other static routes are present. Otherwise, you might need to configure additional route maps to limit the static routes being redistributed. |
3.7.12-3.7.16 | |
| 2934935 |
VXLAN route updates during high frequency might cause switchd to leak memory. |
3.7.14.2-4.3.0 | 4.3.1-4.4.5 |
| 2866084 |
When you reboot a VTEP, MAC address entries might become out of sync between the kernel FDB table and the EVPN MAC VNI table on remote VTEPs. The impacted MAC entries are installed against the rebooted VTEP IP address in the kernel FDB and the correct VTEP IP is present in the EVPN MAC VNI table. To work around this issue, clear all corrupted MAC address entries in the kernel FDB with the bridge fdb del dev command, then add “vxlan-learning”: “off” in the /etc/network/ifupdown2/policy.d/vxlan.json file:$ cat /etc/network/ifupdown2/policy.d/vxlan.jsonReboot the affected switches. |
3.7.12-4.3.0 | 4.3.1-4.4.5 |
| 2866061 |
On the Maverick S4148T switch with MLAG, Cumulus Linux drops LACP, ARP, LLDP and BGP traffic. | 3.7.12-3.7.16 | |
| 2815592 |
In an EVPN configuration, an FRR restart on a border leaf VRRP master causes a stale route for the VRRP VIP on some remote VTEPs to point to the VRRP backup after convergence. | 3.7.12-3.7.15, 4.3.0, 4.4.2-5.0.1 | 3.7.16, 4.3.1, 5.1.0-5.15.0 |
| 2803044 |
In an EVPN configuration with IP or MAC mobility, higher MM EVPN routes do not remove the old ARP entries during VIP migration between VTEP racks. | 3.7.14.2-3.7.15 | 3.7.16 |
| 2801262 |
On NVIDIA Spectrum ASICs in a layer 2 bridge scaled configuration (more than 800 VLANs), clagd.service enters a failed state after a reboot or a switchd restart. |
3.7.12-3.7.15, 4.3.0, 4.4.2-4.4.5 | 3.7.16, 4.3.1, 5.0.0-5.15.0 |
| 2794750 |
When a multipath route that contains an EVPN path exists together with an IPv4 BGP path in the VRF, the RMAC to VTEP binding is incorrect. This invalid entry occurs because Cumulus Linux treats IPv4 routes received over the eBGP IPv4 peering incorrectly in the VRF. To work around this issue, remove the unnecessary eBGP IPv4 peering. |
3.7.12-4.2.1 | 4.3.0-4.4.5 |
| 2754791 |
Remote MAC addreses in zebra are out of sync with bgpd. The zebra MAC addresses point to an incorrect (old) VTEP IP address and the sequence number is one higher than in BGP. |
3.7.14.2-3.7.16, 4.3.0-4.4.5 | |
| 2736265 |
After an apt upgrade, the OPTIONS configuration line in /etc/default/isc-dhcp-relay might be removed. To work around this issue, reconfigure the desired options in the file after the upgrade completes. |
3.7.12-4.3.0 | 4.3.1-4.4.5, 4.4.0-4.4.5 |
| 2730225 |
When withdrawal and advertisement processing occurs in short succession, type-2 routes with an IP are not imported into layer 2 VNIs. | 3.7.12-4.3.0 | 4.3.1-4.4.5, 4.4.2-4.4.5 |
| 2717312 |
When you modify a prefix list with NCLU commands, the bgpd service crashes. |
3.7.14.2-3.7.15 | 3.7.16 |
| 2700767 |
Following an event that causes the peerlink bond MAC address to change, such as a slave port state change, MLAG interfaces might be suspended due to a peer IP mismatch. This behavior is seen when you use a MLAG peer IP linklocal configuration. | 3.7.12-3.7.15, 4.3.0-4.4.5 | 3.7.16 |
| 2687332 |
When you configure BGP aggregate-address summary-only and any component route within the summary updates, all component routes within the summary update in the RIB on the device advertising the summary. This condition might result in increased CPU usageTo workaround this issue, remove the aggregate-address summary-only configuration, add a static route to Null0 for the prefix, and configure an outbound route map to restrict anything more specific than the desired prefix from being advertised. For example: Before:address-family ipv4 unicastAfter: ip route 10.10.0.0/16 Null0This example assumes no other static routes are present. Otherwise, you might need to configure additional route maps to limit the static routes being redistributed. |
3.7.12-4.2.1 | 4.3.0-4.4.5 |
| 2684452 |
When a VTEP is rebooted, MAC address entries might become out of sync between the kernel fdb table and the EVPN MAC VNI table on remote VTEPs. The impacted MAC entries will be installed against the rebooted VTEP IP in the kernel fdb and the correct VTEP IP will be present in the EVPN MAC VNI table You can work around this issue with the following steps:1. Clear all corrupted mac entries in the kernel FDB with the bridge fdb del dev command2. Add “vxlan-learning”: “off” under /etc/network/ifupdown2/policy.d/vxlan.json$ cat /etc/network/ifupdown2/policy.d/vxlan.json3. Reboot the affected switch(es) |
3.7.12-3.7.16 | |
| 2669831 |
If you try to remove BFD configuration with systemctl reload frr, the FRR service fails. The reload action results in a TypeError: expected string or bytes-like object errorYou see this issue only if there is default configuration, such as configuration in the /etc/frr/frr.conf file that is suppressed from view in the FRR running configurationTo work around this issue, remove the default configuration lines; for example: username cumulus nopassword |
3.7.14.2-3.7.15 | 3.7.16 |
| 2669438 |
Editing the /etc/frr/frr.conf file to add a new sequence at the beginning of an existing large prefix list changes the subsequent sequence numbers of the next entries in the list and FRR reload might fail with the error message frr.service reload operation timed out. Stopping. To work around this issue, instead of adding the new prefix using an existing sequence number and pushing other sequences forward, use a sequence number that is free; for example, instead of of using 5 -> 10 -> 15, use 5 -> 7 -> 10. |
3.7.11-3.7.16 | |
| 2660582 |
In an MLAG configuration, the secondary MLAG switch does not use a unique address instead of the MLAG system MAC address when there is a double failure (backup IP and peer link failure) To recover restart the clagd service with sudo systemctl restart clagd.service |
3.7.8-3.7.15 | 3.7.16 |
| 2653400 |
When 802.1x MAB and a parking VLAN are configured on an interface, hostapd might install a static fdb entry if the interface is down. To work around this issue, delete 802.1x from the interface with the net del interface command, then add back the 802.1x configuration. |
3.7.10-3.7.16 | |
| 2645846 |
When 802.1x MAB and a parking VLAN are configured on an interface, hostapd might install a static fdb entry if the interface is down. To work around this issue, delete 802.1x from the interface with the net del interface command, then add back the 802.1x configuration. |
3.7.10-3.7.15 | 3.7.16, 4.3.1-4.4.5 |
| 2638137 |
When you delete a static route using NCLU, the configuration is not deleted from the running configuration or from the /etc/frr/frr.conf file. |
3.7.13-3.7.16 | |
| 2633245 |
On the Dell N3048EP-ON switch, the SPF+ ports remain down after a power cycle. | 3.7.10-3.7.16 | |
| 2607965 |
On the EdgeCore AS7726 switch, when you run the NCLU net show system command, you see the error Command not found. |
3.7.14.2-3.7.16 | |
| 2599607 |
In some corner cases, remote MAC entries may be seen as locally learnt entries in FDB table due to switchd reprogramming it | 3.7.12-4.3.0 | 4.3.1-4.4.5, 4.4.4-4.4.5, 5.0.0-5.15.0 |
| 2595889 |
In a traditional bridge configuration with ip-forward off, neighbors are synchronized to hardware with a switchd restart but are cleared when you flap the bridge interface. |
3.7.10-4.2.1 | 4.3.0-4.4.5 |
| 2595816 |
Tenant VRF BGP peers appear in the EVPN RMAC and nexthop tables, which causes the kernel RMAC to point at invalid IP address. | 3.7.12-4.2.1 | 4.3.0-4.4.5 |
| 2589747 |
If switchd successfully signals clagd that it is going down, clagd stops responding to keepalive echo requests from the peer instead of sending a good bye to the peer over both the peerlink and the backup switch. Eventually, the keepalive timer expires and the secondary switch becomes the primary, and brings the bonds and VNIs back up. However, if switchd does not successfully signal it is going down, (in the event of a crash), the primary switch continues to respond to keepalives, and the bonds and VNIs are down on both peers. |
3.7.12-4.2.1 | 4.3.0-4.4.5 |
| 2581473 |
When netq-agent is installed on the Dell N3048EP platform, switchd might crash if pluggables are installed in the SFP+ ports. | 3.7.13-3.7.15 | 3.7.16 |
| 2562511 |
hostapd does not fail over to secondary RADIUS servers for 802.1x authentication when the primary radius is reachable but not responding to Access-RequestsIf the primary RADIUS server is having a problem servicing requests, you can remove it from the configuration temporarily to force requests to be sent to alternate servers. |
3.7.10-3.7.14.2 | 3.7.15-3.7.16 |
| 2562347 |
When you bring VXLAN interfaces up and down physically or administratively, the MTU for the SVIs changes to 1550 (the default value). | 3.7.14.2-3.7.16 | |
| 2556815 |
When ARP suppression is enabled, RARP packets sometimes get dropped and are not flooded by the local VTEP. To work around this issue, disable ARP suppression. |
3.7.14-4.3.0 | 4.3.1-4.4.5, 4.4.0-4.4.5 |
| 2556763 |
In a configuration with both traditional and VLAN-aware bridges, the VLAN membership check on a VLAN-aware bridge does not drop PVST BPBUs that come from a traditional bridge. | 3.7.14-4.3.0 | 4.3.1-4.4.5, 4.4.0-4.4.5 |
| 2556233 |
Some ECMP next-hops might fail installation into hardware at high ECMP group and route scale. The following log message will be observed when this condition occurs:WARN xx routes reverted to non-ECMP due to NH table capacity |
3.7.9-3.7.14.2 | 3.7.15-3.7.16 |
| 2556037 |
After you add an interface to the bridge, an OSPF session flap might occur |
3.7.9-4.2.0 | 4.2.1-4.4.5 |
| 2556023 |
After upgrading Cumulus Linux with the apt-upgrade command, then rebooting an MLAG pair, if there are no bonds configured with a clag-id, the clagd service has difficulty peering, and holds all MLAG interfaces and VNIs in a proto down stateTo work around this issue, after upgrading both switches, restart the clagd service with the sudo systemctl restart clagd command on each MLAG pair. |
3.7.14-3.7.14.2 | 3.7.15-3.7.16 |
| 2555908 |
If the you add the MLAG backup IP address to the MLAG peer in the secondary role while the peer link is down, the LACP sys-mac does not use the MLAG system MAC address (clagd-sys-mac) when the peer link comes back up To work around this issue, wait until the peer link is up to add the MLAG backup IP address. To recover from this condition, restart clagd with the sudo systemctl restart clagd command. |
3.7.12-4.0.1 | 4.1.0-4.4.5 |
| 2555528 |
In an EVPN Active/Active configuration, when one of the peers reboots and begins to refresh IP neighbor entries shared by the MLAG peer, some of these ARP messages might be dropped by the MLAG peer’s ARP policer. To work around this issue, increase the burst value of the ARP policers to 200 or higher. |
3.7.14-4.2.1 | 4.3.0-4.4.5 |
| 2555401 |
On the Edgecore AS7312 switch, eth0 and swp use the same MAC address. | 3.7.14-4.2.1 | 4.3.0-4.4.5 |
| 2555278 |
When you change the anycast address for the MLAG pair (clagd-vxlan-anycast-ip), high peak traffic occurs on the peer link interface of all MLAG switches. | 3.7.13-3.7.16 | 4.0.0-4.4.5 |
| 2554991 |
When running traditional mode bridges at scale (for example, when you have more than 200 bridges and a large number of MAC addresses), MLAG bonds flap intermittently from dual to single connected, then back to dual connected, which causes a layer 2 loop and STP state changes. To work around this issue, either shut down one side of the MLAG bond or prune out VLANS over the bond. |
3.7.13-4.2.1 | 4.3.0-4.4.5 |
| 2554804 |
On Mellanox SN2010 and SN2100 switches, the maximum fan speed is exceeded by fifteen percent. | 3.7.14-3.7.14.2 | 3.7.15-3.7.16 |
| 2554785 |
After you reboot a Broadcom switch, switchd might fail to restart and you see logs in switchd.log similar to the following:Nov 12 12:20:05.063876 leaf01 switchd[9867]:Nov 12 12:20:05.064310 leaf01 switchd[9867]: hal_bcm_console.c:294 0:system_init:Nov 12 12:20:05.064428 leaf01 switchd[9867]: hal_bcm_console.c:294 system_init: Misc init failed: Operation timed outNov 12 12:20:05.064464 leaf01 switchd[9867]:Nov 12 12:20:05.091995 leaf01 switchd[9867]: hal_bcm_console.c:294 LED: Loading 256 bytes into LED program memoryNov 12 12:20:05.092029 leaf01 switchd[9867]:Nov 12 12:20:05.099547 leaf01 switchd[9867]: hal_bcm_console.c:294 PORT: Error: bcm ports not initializedNov 12 12:20:05.099579 leaf01 switchd[9867]:Nov 12 12:20:05.099646 leaf01 switchd[9867]: hal_bcm_console.c:294 Error: file /var/lib/cumulus/rc.datapath_0: line 81 (error code -1): script terminatedNov 12 12:20:05.099667 leaf01 switchd[9867]:Nov 12 12:20:05.099775 leaf01 switchd[9867]: hal_bcm_console.c:294 Error: file /etc/bcm.d/rc.soc: line 70 (error code -1): script terminatedNov 12 12:20:05.099798 leaf01 switchd[9867]:Nov 12 12:20:05.099871 leaf01 switchd[9867]: hal_bcm_console.c:294 ERROR loading rc script on unit 0Nov 12 12:20:05.099892 leaf01 switchd[9867]:Nov 12 12:20:05.099943 leaf01 switchd[9867]: hal_bcm_console.c:299 CRIT loading of rc script failed, aborting!To work around this issue, configure Cumulus Linux to boot with the ntel_iommu=off kernel command option:1. Open the /etc/default/grub file with a text editor2. Edit the GRUB_CMDLINE_LINUX variable by adding the string intel_iommu=off at the end. For example: GRUB_CMDLINE_LINUX=“cl_platform=cel_e1031 console=ttyS1,115200n8 intel_iommu=off"3. Run the update-grub command4. Reboot the switch. |
3.7.11-4.2.1 | 4.3.0-4.4.5 |
| 2554719 |
A slow memory leak is observed (1% per 14 hours) in kmalloc-256. To work around this issue, reboot the switch. |
3.7.12-3.7.14.2 | 3.7.15-3.7.16 |
| 2554709 |
The IP address specified in the ip pim use-source command configured on the loopback interface should be inherited by unnumbered interfaces during their Primary IP address selection process. If ip pim use-source is configured on the loopback after an unnumbered interface has already selected their Primary IP address, the unnumbered interface does not update its Primary IP address to be the new use-source value until after there is a netlink update for that interface.To work around this issue, configure ip pim use-source on each unnumbered interface directly or ensure ip pim use-source is applied to the loopback before other unnumbered interfaces are enabled for PIM. |
3.7.13-3.7.16, 4.2.1-4.4.5 | |
| 2554588 |
If you try to reconfigure a DHCP server after you delete the switch configuration with the net del all command, the dhcpd service fails because a duplicate process is runningTo work around this issue, edit the /usr/lib/python2.7/dist-packages/nclu/plugins/dhcp.py file to change:DHCPD_PID="-pf {0}” to:DHCPD_PID="-pf {1}" |
3.7.13-4.2.1 | 4.3.0-4.4.5 |
| 2554369 |
Certain Dell S4048-ON switches show an incorrect vendor name and hang when you issue the reboot command. |
3.7.12-4.2.1 | 4.3.0-4.4.5 |
| 2554329 |
On the Dell N3248PXE switch, fixed RJ45 interfaces with PoE neighbors can end up in Paused mode after a switchd restart, which blocks traffic on that interface. |
3.7.12-3.7.16 | |
| 2553887 |
When using TACACS+ configured with a DEFAULT user providing privilege level lower than 16, TACACS+ configured users with privilege level 16 access might not be able to run privilege level 16 NCLU commands, such as net add and net del and see an error similar to the following:
To work around this issue, remove the DEFAULT user from the TACACS+ server. |
3.7.7-3.7.16, 4.0.0-4.4.5 | |
| 2553748 |
On switches with the Spectrum ASIC, the IPv6 default route is present in the kernel but missing in hardware. | 3.7.11-4.2.1 | 4.3.0-4.4.5 |
| 2553677 |
When you configure an SNMPv3 user with the net-snmp-config configuration command from the libsnmp-dev package, you get an error message similar to the one below:
To work around this issue, use the NCLU command to configure SNMPv3 user parameters; for example:
Alternatively, directly edit the /etc/snmp/snmpd.conf file as described in the documentation. |
3.7.13-3.7.16, 4.0.0-4.4.5 | |
| 2553219 |
You cannot configure SNMPv3 trap-destinations in non-default VRFs with an authentication username that contains fewer than eight characters. | 3.7.12-4.2.1 | 4.3.0-4.4.5 |
| 2553116 |
When you manually set the link speed or duplex mode with ethtool to an unsupported value, then run a TDR check against the interface, you encounter a switchd service heartbeat failure.To work around this issue, reboot the switch to clear the condition. Avoid setting the interface speed or duplex mode directly with ethtool. |
3.7.12-3.7.16, 4.0.0-4.4.5 | |
| 2553050 |
SNMP status might incorrectly reflect that a BGP neighbor is down due to an issue between bgpd and SNMP AgentX when the IP-FORWARD-MIB is also polled.To work around this issue, avoid polling IP-FORWARD-MIB objects. |
3.7.12-3.7.16 | |
| 2553015 |
If a neighbour contains a special character in PortID for LLDP, the net show interface command does not display the LLDP information or the command might fail. |
3.7.10-3.7.16, 4.2.0-4.4.5 | |
| 2552939 |
RX_DRP on a bond interface increases without any data traffic while the slave port does not increase. | 3.7.12-4.2.1 | 4.3.0-4.4.5 |
| 2552869 |
On the Dell N3048EP switch, the module information from SFP ports is not displayed in the l1-show command.To work around this issue, use the ethtool -m command. |
3.7.13-4.2.1 | 4.3.0-4.4.5 |
| 2552742 |
On the Mellanox SN2410 switch, you see switchd core and GBIN_MALLOC errors.To work around this issue, restart switchd. |
3.7.12-4.2.1 | 4.3.0-4.4.5 |
| 2552739 |
Counters for IPROUTER rules do not increase when traffic is forwarded to the CPU because there is no IP neighbor. | 3.7.2-3.7.16 | |
| 2552294 |
NCLU restarts FRR when removing a BGP VRF IPv4 aggregate-address command. |
3.7.12-3.7.16, 4.0.0-4.4.5 | |
| 2551911 |
ifupdown2 does not account for link status or link down configuration when running dhclient. For example, ifupdown2 ignores link-down yes during ifup/ifreload and runs the DHCP module if inet dhcp is configured on the interface. ifupdown2 also runs the DHCP module even when the physical link configured for DHCP is down. |
3.7.12-4.2.0 | 4.2.1-4.4.5 |
| 2551578 |
When you configure a bridge in the /etc/network/interfaces file, then try to reconfigure the bridge to be a VRF interface with the same name, ifreload/ifup commands fail with an invalid table id or unable to get vrf table id error. |
3.7.12-3.7.16, 4.0.0-4.4.5 | |
| 2551565 |
If you toggle VRRP priority values between VRRP routers, then restart switchd, a few IPv6 VRRP instances might not converge. As a result, both the VRRP routers act as master routers for the impacted IPv6 VRRP instances. IPv4 VRRP instances are not affectedTo work around this issue, remove, then add back the VRRP configuration with NCLU or vtysh commands. |
3.7.13-3.7.16, 4.2.0-4.4.5 | |
| 2551305 |
The net show configuration command provides the wrong net add command for ACL under the VLAN interface. |
3.7.12-3.7.16, 4.1.0-4.4.5 | |
| 2551288 |
When you remove BFD configuration by editing the /etc/frr/frr.conf file and restarting FRR, you see a traceback.To work around this issue, either use NCLU or vtysh commands to remove the BFD configuration, or restart FRR with the new /etc/frr/frr.conf file. |
3.7.7-3.7.16 | 4.0.0-4.4.5 |
| 2550974 |
On the Dell S3000 switch, after installing the Cumulus Linux 4.1.1 disk image without a license, the switch sends a link beat if a remote host port is configured. | 3.7.11-3.7.16, 4.1.1-4.4.5 | |
| 2550942 |
NCLU tab completion for net show displays the text add help text instead of system Information for the system option. |
3.7.11-4.2.0 | 4.2.1-4.4.5 |
| 2550796 |
On a Broadcom switch with the Trident2+ ASIC, ACL rules for VLANs are not applied after a reboot and the counters remain at zero. To work around this issue, either do not set acl.non_atomic_update_mode = TRUE in the /etc/cumulus/switchd.conf file or run the cl-acltool -i command after the reboot to install the ACLs. |
3.7.12-4.2.1 | 4.3.0-4.4.5 |
| 2550793 |
The NCLU net show bridge spanning-tree command displays the aging timer incorrectly. |
3.7.12-3.7.16, 4.0.0-4.4.5 | |
| 2550600 |
The received PVST BPDU for a VLAN is flooded even though the ingress port doesn’t have the VLAN tagged. | 3.7.8-3.7.14.2, 4.0.0-4.3.0 | 3.7.15-3.7.16, 4.3.1-4.4.5, 4.4.0-4.4.5 |
| 2550478 |
VXLAN interface as in-interface or out-interface in an ACL is not supported in Spectrum-based switches. | 3.7.7-4.2.0 | 4.2.1-4.4.5, 4.3.0-4.4.5 |
| 2550444 |
Tab completion for the net show rollback description command returns information about a snapshot instead of context help.To work around this issue, run the net show commit history command to find descriptions instead of the net show rollback description command. |
3.7.12-3.7.16, 4.0.0-4.4.5 | |
| 2550443 |
The net show rollback description command returns an error even if the string matches a commit description.To work around this issue, look for your string in the output of the net show commit history command (or grep for it there) instead. |
3.7.12-3.7.16, 4.0.0-4.4.5 | |
| 2550276 |
In LLDP, the snmp subagent loses all subsequent lldpRemSysName (1.0.8802.1.1.2.1.4.1.1.9) entries after an entry with a missing SysName is added.All the information from lldpctl is correct. Only the entries after the entry that is missing a SysName in lldpRemSysName disappear from the snmp subagent. |
3.7.12-4.2.1 | 4.3.0-4.4.5 |
| 2550243 |
When you use nginx and restserver in management VRF to provide a REST API for the switch, nginx starts but restserver fails to start.To work around this issue, comment out the Requires= line in the /lib/systemd/system/restserver.service. For example:
|
3.7.12-3.7.16, 4.0.0-4.4.5 | |
| 2550056 |
The ACCTON-DIAG option under the Cumulus Linux GRUB menu does not work. When you select this option, you see the following error:
|
3.7.12-3.7.16, 4.1.1-4.4.5 | |
| 2549925 |
When you run an Ansible script to replace the /etc/network/interfaces file, then run the ifreload -a command, you see errors similar to the following:
To work around this issue, run the ifreload -a command a second time. |
3.7.12-3.7.16, 4.0.0-4.4.5 | |
| 2549872 |
If you have an SVI with multiple VRR IP addresses and try to delete one of the VRR configurations, net commit or ifreload -a returns an error. |
3.7.12-3.7.16, 4.1.1-4.4.5 | |
| 2549838 |
In vtysh, if you configure, then remove a layer 3 VNI for a VRF, the VNI is removed from zebra even if the VNI interface still exists in the kernel. If you configure a layer 2 VNI as a layer 3 VNI by mistake, removing the layer 3 VNI binding removes it from zebra but EVPN-learned MACs and neighbors are not installed into the kernel. To work around this issue, delete, then re-add the missing VNI. For example:
If you flap the link with the ip link set vni10100 down; ip link set vni10100 up commands, zebra does not re-add the VNI. |
3.7.12-4.2.1 | 4.3.0-4.4.5 |
| 2549782 |
The JSON format output of the net show bgp l2vpn evpn summary command shows the incorrect neighbour state. |
3.7.12-3.7.16, 4.0.0-4.4.5 | |
| 2549731 |
When you create SPAN or ERSPAN rules in ebtables, the action fails to install if it is not in lowercase. Make sure that the SPAN or ERSPAN action is all lowercase; for example:
|
3.7.12-3.7.16, 4.1.1-4.4.5 | |
| 2549472 |
On switches with the Trident3 ASIC, PFC is not working as expected. If you set the PFC for only one CoS, pause frames are sent for all CoS traffic. | 3.7.11-4.1.1 | 4.2.0-4.4.5 |
| 2549371 |
When Optimized Multicast Flooding (OMF) is enabled with the bridge.optimized_mcast_flood = TRUE setting in the /etc/cumulus/switchd.conf file, the switch continues to flood IPv6 multicast traffic to all slave ports when there is no MLD join receive. |
3.7.11-4.3.3 | 4.4.0-4.4.5 |
| 2549226 |
You might see the following gport error messages in switchd.log:
These messages are harmless and can be ignored. |
3.7.12-4.2.1 | 4.3.0-4.4.5 |
| 2548962 |
With FRR or OSPF, you might see an inconsistent link-state advertisement. For example, when you configure the OSPF default originate route as metric-type 1 with a specific metric, Cumulus Linux shows the default originate route as an external metric-type 2 route with the default metric in the database. This issue typically occurs when both IPv4 and IPv6 default routes exist in the routing table. | 3.7.12-4.1.1 | 4.2.0-4.4.5 |
| 2548930 |
On Mellanox Spectrum switches that contain an OSPF IP unnumbered neighborship with a high scale of prefixes being learned, a link flap might cause the neighbor entry to not be programmed in hardware. | 3.7.11-4.2.1 | 4.3.0-4.4.5 |
| 2548746 |
On the Broadcom switch with the Trident3 ASIC, packet priority remark values assigned from each internal CoS value continue to work with default values; if you change the internal CoS value, the change does not take effect. | 3.7.11-4.1.1 | 4.2.0-4.4.5 |
| 2548657 |
When you upgrade Cumulus Linux on the EdgeCore AS7726-32X or AS7326-56X switch, you might see firmware errors similar to the following:
You can safely ignore these error messages. |
3.7.12-3.7.16, 4.0.0-4.4.5 | |
| 2548490 |
A change in a route map prefix list that should remove a route might not be reflected in the ospf6 database or in peers, and the route might not be deleted. To work around this issue, reenter the redistribute <connected|static> route-map statement in the configuration. |
3.7.11-4.1.1 | 4.2.0-4.4.5 |
| 2548485 |
If you configure the aggregate-address summary-only option before injecting a component of the same aggregate into the BGP table with the network or redistribute command, when you remove the aggregate-address configuration, the component stays suppressed; it is not advertised to peers. For example:Existing configuration:router bgp 1If you add network 50.0.0.1/32, you see the following (expected) BGP table entries:Status codes: s suppressed, d damped, h history, * valid, > best, = multipath,Removing aggregate-address 50.0.0.0/8 summary-only at this point results in the following (unexpected) BGP table entry:Status codes: s suppressed, d damped, h history, * valid, > best, = multipath,To work around this issue, remove, then re-add the component prefix routes. |
3.7.12-4.2.1 | 4.3.0-4.4.5 |
| 2548243 |
On switches with the Trident2+ ASIC, adding SPAN rules disables PBR rules. | 3.7.3-3.7.16, 4.0.0-4.4.5 | |
| 2548155 |
The net show bgp neighbor swpX json command shows negative output for the bgpTimerUpMsec timer. |
3.7.10-3.7.16 | 4.0.0-4.4.5 |
| 2548117 |
In OVSDB traditional bridge mode, adding or removing a VLAN binding causes a traffic forwarding outage for around 20 seconds or more on adjacent VLAN bindings. Cumulus Linux does not support traditional bridge mode with VMware NSX. | 3.7.12-3.7.16, 4.0.0-4.4.5 | |
| 2548044 |
When a remote VTEP withdraws a type-3 EVPN route, Cumulus Linux purges all MAC address and neighbor entries installed in the corresponding layer 2 VNI through that remote VTEP from the local EVPN and kernel forwarding tables. This purge occurs even if the remote VTEP does not withdraw type-2 routes carrying the MAC address or neighbor entries. The entries stay missing from the local EVPN and kernel forwarding tables until BGP updates the MAC address and neighbor. | 3.7.12-3.7.15, 4.0.0-4.4.5 | 3.7.16 |
| 2548024 |
On the Dell Z9100 switch, 100G-SR4 modules might not link up reliably in certain ports. swp1, 2, 3, 9, 10, 23, 24, 30, 31, and 32 might be affected To work around this issue, move 100G SR4 modules to one of the ports not affected by this issue. |
3.7.11-4.1.1 | 4.2.0-4.4.5 |
| 2547942 |
On the Lenovo NE0152T switch, one power supply (PSU2) always show as ABSENT in smonctl. | 3.7.11-4.0.1 | 4.1.0-4.4.5 |
| 2547839 |
When you try to configure link-down on a parent interface of a subinterface configured in a VRF, you encounter an error. |
3.7.11-4.1.1 | 4.2.0-4.4.5 |
| 2547782 |
If a LLDP neighbor advertises a PortDescr that contains commas, ptmctl -d splits the string on the commas and misplaces its components in other columns. |
3.7.11-3.7.16, 4.0.0-4.4.5 | |
| 2547706 |
When you configure ganged ports in the ports.conf file, the change does not take effect after you restart switchd. To work around this issue, reboot the switch. |
3.7.11-3.7.16, 4.0.0-4.4.5 | |
| 2547659 |
On the EdgeCore AS7326-56X switch, the default fan speed, which is defined in the thermal specification, results in excessive fan noise. | 3.7.11-4.0.1 | 4.1.0-4.4.5 |
| 2547573 |
On Tomahawk switches, when the vxlan_tnl_arp_punt_disable option is set to FALSE, ARP packets are not forwarded to the CPU. |
3.7.9-3.7.16 | |
| 2547443 |
On the Dell N3248PXE-ON switch, 25G SFP ports do not work in 10G mode. | 3.7.11-4.0.1 | 4.1.0-4.4.5 |
| 2547381 |
The hsflowd service sends an undefined header protocol 0 in the sampled flow sample to the collector, which is not recognized by the sFlow tool. You see errors similar to the following:
|
3.7.11-3.7.16 | 4.0.0-4.4.5 |
| 2547349 |
When you change an interface IP address, then change it back, static routes are misprogrammed One of the following actions recovers the routes:- Bounce both layer 3 interfaces- Remove or add static routes in FRR- Restart FRR |
3.7.11-3.7.16 | 4.0.0-4.4.5 |
| 2547123 |
On the Broadcom switch with the Trident3 ASC, packet priority remark values assigned from each internal CoS value continue to work with default values; if you change the internal CoS value, the change does not take effect. | 3.7.11-4.1.1 | 4.2.0-4.4.5 |
| 2547120 |
After you hot swap a PSU, the decode-syseeprom -t psuX command shows the old PSU information (such as the serial number), until you run the decode-syseeprom –init command. |
3.7.11-3.7.16, 4.0.0-4.4.5 | |
| 2547100 |
On switches with the Trident3 ASIC, PFC is not working as expected. If you set the PFC for only one CoS, pause frames are sent for all CoS traffic. | 3.7.11-4.1.1 | 4.2.0-4.4.5 |
| 2547068 |
Hardware platforms using the Intel D-1500 CPU series might reboot unexpectedly To work around this issue, contact your hardware vendor to inquire if a new version of BIOS with a microcode fix is available or manually disable CPU C-states in the kernel as outlined below To permanently disable C-states using a kernel boot parameter:1. Edit /etc/default/grub to add the argument processor.max_cstate=0 to the variable GRUB_CMDLINE_LINUX. For example, if /etc/default/grub file contains the line GRUB_CMDLINE_LINUX=“cl_platform=accton_as7726_32x console=tty0 console=ttyS0,115200n8 intel_iommu=off pcie_aspm=off”, change it to GRUB_CMDLINE_LINUX=“cl_platform=accton_as7726_32x console=tty0 console=ttyS0,115200n8 intel_iommu=off pcie_aspm=off processor.max_cstate=0”2. Run sudo update-grub3. Reboot the system with sudo rebootTo disable cstates in realtime on the current system, which does not persist through a reboot:1. Confirm that the libpci3 package is installed. Run dpkg-query -l libpci3 and confirm the following line is displayed:ii libpci3:amd64 1:3.2.1-3 amd64 Linux PCI Utilities (shared library)The first field above should read ii. If not, install the libpci3 package by running sudo apt upgrade;sudo apt install libpci32. Disable C-states by running the command ./cpupower idle-set -d 2C-states are disabled by default in Cumulus Linux 4.3.0 and later. |
3.7.9-4.2.1 | 4.3.0-4.4.5 |
| 2546991 |
The FRR service does not provide a way for automation to know if the configuration applied properly. To work around this issue, execute the vtysh -f command in the automation file before starting the FRR service to validate the functional configuration and return an error code. |
3.7.11-3.7.16, 4.0.0-4.4.5 | |
| 2546895 |
If you have configured a higher number of ports and VLANs (ports x VLANs) or the switch is a lower-powered (CPU) platform, the switchd service might fail to send a systemd keepalive within the watchdog timeout value (2 minutes by default) and you see an error similar to the following:bq. systemd[1]: switchd.service watchdog timeout (limit 2min)!To workaround this issue, either reduce the number of configured interfaces and, or VLANs, or increase the systemd timeout for switchd.serviceTo increase the systemd timeout:1.Edit the /etc/systemd/system/switchd.service.d/override.conf file and increase the WatchdogSec parameter2.Restart the switchd service with the sudo systemctl restart switchd.service commandsystemd attempts to restart the switchd service automatically (after the watchdog timeout). If the restart fails multiple times in a short time period, run the sudo systemctl reset-failed command followed by the sudo systemctl restart switchd command. |
3.7.11-3.7.16, 4.0.0-4.4.5 | |
| 2546450 |
On the EdgeCore AS7326-56X switch, you might see the RPM of certain fans run over the maximum threshold. | 3.7.11-3.7.16 | |
| 2546385 |
SNMP ifLastChange reports link transitions when there are none. | 3.7.6-3.7.16 | |
| 2546225 |
When you execute the following command on the Delta AG6248C switch, the switch reboots and then comes right back into Cumulus Linux without installing the new image. The install image is still in /var/lib/cumulus/installer, which causes issues with cl-support.
To work around this issue, use the onie-select command to access ONIE, and then use the nos-install command in ONIE to install a new binary image. |
3.7.11-3.7.16, 4.0.0-4.4.5 | |
| 2546203 |
When using QinQ with a traditional bridge, if you enable the LLDP dot1 TLV option, you see the following suboptimal behavior: * Both the inner and outer VLAN information is sent as part of VLAN TLVs in the LLDP packet. * If the outer VLAN ID is the same as the inner VLAN ID, only one VLAN TLV is sent with that VLAN ID in the LLDP packet. |
3.7.11-3.7.16 | |
| 2546131 |
On the Delta AG-6248C PoE switch, when you run the apt upgrade command, the upgrade does not work. Cumulus Linux uses uboot directly instead of grub to boot the kernel. Uboot needs a special header to boot the kernel, which is not present. Without this header, when you use the apt upgrade command to upgrade Linux packages, uboot is unable to boot up the kernel. To work around this issue, upgrade Cumulus Linux by installing the Cumulus Linux image. Run the onie-select command to go into ONIE, and then use the nos-install command in ONIE to install a new image.This workaround only works when an out-of-band network is present. |
3.7.11-3.7.16, 4.0.0-4.4.5 | |
| 2546010 |
When hal.bcm.per_vlan_router_mac_lookup is set to TRUE in the /etc/cumulus/switchd.conf file, inter-VLAN traffic is forwarded to the CPU when associated VNI interfaces exist. |
3.7.10-3.7.16 | |
| 2545997 |
The NCLU command net show interface produces an error if bonds with no members exist.To work around this issue, remove the empty Bond interfaces from the /etc/network/interfaces file and run sudo ifreload -a. |
3.7.10-3.7.16 | |
| 2545566 |
The Dell Z9100-ON switch incorrectly reports many sensors as ABSENT. | 3.7.12-4.0.1 | 4.1.0-4.4.5 |
| 2545446 |
If you use NCLU commands to add a non-MLAG bond, then add an MLAG configuration, the net commit command fails. However, a subsequent net commit command succeeds. |
3.7.10-3.7.16 | |
| 2545125 |
If you configure more than one VRR interface on an SVI interface, deleting one of the VRR addresses does not remove the interface/address. | 3.7.10-3.7.16, 4.0.0-4.4.5 | |
| 2544978 |
If you delete an undefined bond, then add a bond slave, the net commit command fails. |
3.7.9-3.7.16, 4.0.0-4.4.5 | |
| 2544968 |
FRR configuration commands for an SVI interface might have the \n misplaced in the output. For example:
should be:
To work around this issue, configure the interface manually in the /etc/frr/frr.conf file. |
3.7.9-3.7.16, 4.0.0-4.4.5 | |
| 2544953 |
When you update the hostname of a switch with the NCLU net add hostname command, then run net commit, the lldpd service does not restart and other devices still see the old hostname.To work around this issue, run the sudo systemctl restart lldpd.service command. |
3.7.10-3.7.16, 4.0.0-4.4.5 | |
| 2544904 |
After you delete an IPv6 numbered BGP peer group neighbor, Cumulus Linux might continue to send route advertisements. To work around this issue, restart FRR after removing the IPv6 numbered configuration. |
3.7.9-4.1.1 | 4.2.0-4.4.5 |
| 2544829 |
Frames received with a VLAN tag of 0 on an interface configured as a bridge port and forwarded to the CPU for processing might appear tagged with the native VLAN when viewed with tcpdump. |
3.7.8-3.7.16 | |
| 2544556 |
If you reconfigure an NTP server with NCLU using different trailing options after the IP address (such as iburst), an invalid configuration is added to the /etc/ntp.conf file. For example:
If you need to alter existing server configurations, first remove the server, commit, then re-add the server with any trailing options. |
3.7.9-4.1.1 | 4.2.0-4.4.5 |
| 2544463 |
Auto-negotiation does not work with the QSFP28 cables and a remote system operating at 10G. Attempting to enable auto-negotiation with ethtool -s swp<#> autoneg on returns Operation not supported.To work around this issue, do not use auto-negotiation and set the local port speed to 10G. |
3.7.9-3.7.16, 4.0.0-4.4.5 | |
| 2544456 |
The NCLU net show lldp command displays the speed of a ganged port group as the speed of one of the individual links, rather than the sum of their speeds. |
3.7.9-3.7.16, 4.0.0-4.4.5 | |
| 2544311 |
Applying a policy-based routing (PBR) rule for all traffic from a host might disrupt ARP refresh for that connected host. | 3.7.5-3.7.16, 4.0.0-4.4.5 | |
| 2544155 |
NCLU requires you to specify an interface with multiple address-virtual statements in ascending MAC address order. |
3.7.5-3.7.16, 4.0.0-4.4.5 | |
| 2544113 |
Mac learning is not disabled by default on a double tagged peer link interface resulting in the MAC address changing between the MLAG bond and the peer link. To work around this issue, disable MAC learning on QinQ VLANs by adding bridge-learning off to the VLAN stanza in the etc/network/interfaces file. |
3.7.9-3.7.16, 4.0.0-4.4.5 | |
| 2543900 |
On the Mellanox switch, static VXLAN tunnels incorrectly allow traffic from any remote tunnel IP address. | 3.7.8-3.7.16, 4.0.0-4.4.5 | |
| 2543841 |
The net show evpn vni detail json command includes an extra empty dictionary at the end of the output. |
3.7.8-3.7.16, 4.0.0-4.4.5 | |
| 2543840 |
On the Mellanox SN2700 switch, you cannot enable resilient hashing (RASH) and set the bucket size to 64 in the traffic.conf file. |
3.7.6-3.7.16 | |
| 2543800 |
When local-tunnelip is an SVI, the static VXLAN tunnel does not work; the next hop router receives the packet but drops it as it does not know where to forward the packet. The static VXLAN tunnel does works if local-tunnelip is a loopback or a physical layer 3 interface. |
3.7.8-3.7.16 | 4.0.0-4.4.5 |
| 2543647 |
ERSPAN in ebtables does not work for VNIs. For example, the following rule does not work:
|
3.7.6-4.2.1 | 4.3.0-4.4.5 |
| 2543646 |
In an ebtables rule, ERSPAN (upper case) does not work. You need to specify erspan (lower case). | 3.7.6-3.7.16, 4.0.0-4.4.5 | |
| 2543627 |
Tomahawk 40G DACs cannot disable auto-negotiation. | 3.7.7-3.7.16 | 4.0.0-4.4.5 |
| 2543270 |
The default route injected through OSPF when you configure default-information originate always is unreliable and might age out unexpectedly.To work around this issue, rely on a different source of default route other than injection with default-information originate. |
3.7.8-4.1.1 | 4.2.0-4.4.5 |
| 2543211 |
In some cases, the switchd service might warn of excessive MAC moves from one switch port to itself (for example, from swp18 to swp18). |
3.7.0-3.7.16, 4.0.0-4.4.5 | |
| 2543164 |
The MTU of an SVI cannot be higher than the MTU on the bridge. Changing the MTU on the SVI with NCLU does not update the bridge MTU. The net commit command succeeds even though the MTU is not changed as expected.To work around this issue, change the MTU on all SVIs and the bridge manually in the /etc/network/interfaces file, then apply the change with the ifreload -a command. |
3.7.7-3.7.16, 4.0.0-4.4.5 | |
| 2543096 |
When an SVI with a virtual MAC is configured with a layer 2 VNI in an EVPN environment, if you replace the /etc/network/interfaces file with a different file that does not have the SVI and layer 2 VNI configuration, the original virtual MAC is not populated through the EVPN route until FRR is restarted. |
3.7.6-3.7.16, 4.0.0-4.4.5 | |
| 2543058 |
The IP neighbor entry for a link-local next hop is not installed by FRR, which results in a forwarding failure for routes via that next hop. This is a rare problem that occurs with IPv4 route exchange over IPv6 GUA peering with no IPv4 addresses on the interfaces. To work around this issue, flap the peering to the peer router (which might be a route reflector) to recover. To avoid this issue, configure IPv6 router advertisements on the connecting interfaces. |
3.7.7-3.7.16 | 4.0.0-4.4.5 |
| 2543052 |
Received EVPN type-5 and type-2 MACIP routes are not installed in the kernel (and hardware) routing tables for the associated VRF, which causes traffic to be blackholed. The failure to install the default route causes complete reachability failure for the particular tenant on the affected racks. The routes that are not installed are seen as “inactive” in the routing subsystem (FRR) VRF routing table. This problem is rare and can occur only in EVPN configurations that have user-configured route targets (RTs) for tenant VRFs, and only following a restart of FRR. To work around this issue, either restart the FRR service on the affected switch with the sudo systemctl restart frr.service command or bounce the layer 3 SVI for the affected VRF; for example:
You can run the net show vrf vni command to print a mapping of VRF : L3-VNI : L3-SVI. |
3.7.5-3.7.16 | 4.0.0-4.4.5 |
| 2543044 |
Under certain conditions, EVPN next hops might not be removed when the contributing peer goes down or might not be populated when the BGP session to the contributing peer comes up. You can prevent EVPN next hops from not being removed when the contributing peer goes down by specifying static MAC addresses on all layer 3 VNIs. There is no workaround for preventing EVPN next hops from not being populated when the BGP session to the contributing peer comes up. |
3.7.2-3.7.16 | 4.0.0-4.4.5 |
| 2542979 |
On the Dell-N3048EP-ON switch, when you run the sudo -E apt upgrade command, the upgrade does not work. |
3.7.7-4.1.1 | 4.2.0-4.4.5 |
| 2542945 |
On the Broadcom Maverick switch with a QinQ configuration, the packets coming into the CPU might be tagged incorrectly; for example, 802.1ad + 802.1q tags are expected in the packets but the packets have 802.1q + 802.1q tags. To work around this issue, configure the bridge with bridge-vlan-protocol 802.1ad:
|
3.7.6-3.7.16, 4.0.0-4.4.5 | |
| 2542310 |
hsflow disregards the setting for agent.cidr in the /etc/hsflowd.conf file and selects an IPv6 agent address. The source IP address of the hsflowd packet is IPv4, but the agent address in the hsflow payload shows IPv6. |
3.7.6-3.7.16 | |
| 2542305 |
If an SVI exists in the configuration before you assign it an IP address, when you do assign the IP address with the NCLU command, the vlan-id and the raw-device bridge stanzas are not added automatically. |
3.7.6-3.7.16, 4.0.0-4.4.5 | |
| 2542301 |
When first creating a bond and enslaving an interface, NCLU hides some of the bridge command suggestions, although they are still accepted. |
3.7.3-3.7.16, 4.0.0-4.4.5 | |
| 2541212 |
The maximum-prefix configuration under the IPv4 address family has an optional restart value, which you can configure. This configuration is ignored and, instead of restarting the sessions every x minutes, the peer constantly changes between established and idle due to the prefix count being exceeded. |
3.7.5-3.7.16, 4.0.0-4.4.5 | |
| 2541165 |
On the Dell N3048EP-ON switch, UPOE is supported only on ports 1 thru 12. (UPOE uses all four pairs of standard Ethernet cabling whereas PoE delivers power over two twisted pairs.) When you plug a UPOE device in a port higher than port 12, poectl reports that four_pair_mode_enabled is true. However, this configuration is not supported on the port so poectl should report that four_pair_mode_enabled is false. |
3.7.6-3.7.16 | |
| 2541029 |
On switches with the Trident2 ASIC, 802.1Q-encapsulated control plane traffic received on an interface with 802.1AD configured subinterfaces might be dropped. This issue only affects QinQ configurations. |
3.7.5-3.7.16, 4.0.0-4.4.5 | |
| 2540950 |
On the QuantaMesh T4048-IX8 or EdgeCore AS7326-56X switch, when using a 1000BASE-T SFP module, the module LEDs do not light to reflect link status. |
3.7.3-4.1.1 | 4.2.0-4.4.5 |
| 2540885 |
The Dell N3048EP-ON switch does not support 1G Base-T modules in the SFP ports. | 3.7.7-3.7.16 | |
| 2540863 |
On the EdgeCore AS5812-54X switch, the PSU2 Fan1 fluctuates between OK and LOW. When the fan speed is reported as LOW, the RPM is shown as a negative number. |
3.7.3-3.7.16 | |
| 2540753 |
If the interface alias contains a single or double quotation mark, or an apostrophe, the net show configuration commands fail with the following error:
|
3.7.5-3.7.16, 4.0.0-4.4.5 | |
| 2540444 |
SNMP incorrectly requires engine ID specification. |
3.7.4-3.7.16, 4.0.0-4.4.5 | |
| 2540352 |
When you use NCLU to configure a route map, the parser allows for glob matching of interfaces for a match interface condition when there can only be a single interface matched. The proper syntax is to use multiple route map clauses, each matching a single interface, instead of a single clause matching multiple interfaces. For example, this command is incorrect:
These commands are correct:
|
3.7.2-3.7.16, 4.0.0-4.4.5 | |
| 2540340 |
NCLU allows for the configuration of addresses on VRF interfaces, but tab completion for the net add vrf command just displays
Tab completion for the net add vrf command works correctly. |
3.7.4-3.7.16, 4.0.0-4.4.5 | |
| 2540274 |
On the Maverick switch, CPU forwarded packets might be dropped when there is no route to a leaked host route. | 3.7.5-3.7.16, 4.0.0-4.4.5 | |
| 2540204 |
When links come up after FRR is started, VRF connected routes do not get redistributed. | 3.7.4-3.7.16, 4.0.0-4.4.5 | |
| 2540192 |
The net del bridge bridge mcsnoop yes command does not return the value to the default of disabled. To work around this issue, use the net add bridge bridge mcsnoop no command to delete the mcsnoop attribute and return to the default value. |
3.7.4-3.7.16, 4.0.0-4.4.5 | |
| 2540155 |
On the Broadcom switch, when moving configuration from bridged to routed (or toggling from routed to bridged to routed), some traffic is not seen by the kernel. This can cause BGP to not establish on a transit node. |
3.7.3-3.7.16, 4.0.0-4.4.5 | |
| 2540042 |
When you try to configure the VRRP priority and advertisement-interval with NCLU on a traditional mode bridge, the net commit command fails. To work around this issue, use the vtysh command (inside FRR) to change the VRRP priority or advertisement-interval on traditional bridges. For example:
|
3.7.4-3.7.16, 4.0.0-4.4.5 | |
| 2540041 |
On SVIs in a VLAN-aware bridge, you cannot change the VRRP priority with NCLU. To work around this issue, run the vtysh command inside FRR to change the default priority. For example:
|
3.7.4-3.7.16, 4.0.0-4.4.5 | |
| 2540040 |
Cumulus Linux uses VRRPv3 as the default version, and enables both preempt and accept mode by default. You cannot change these default values with NCLU. To work around this issue, run the vtysh commands (inside FRR) to change the default values. For example:
|
3.7.4-3.7.16, 4.0.0-4.4.5 | |
| 2540031 |
NCLU does not honor auto all in the /etc/network/interfaces file and removes the existing configuration if no individual auto lines exist. |
3.7.3-3.7.16, 4.0.0-4.4.5 | |
| 2539994 |
When you try to remove a BGP peer group configuration with NCLU, the command fails but no warning message is shown. For example:
|
3.7.2-3.7.16, 4.0.0-4.4.5 | |
| 2539962 |
When an LDAP user that does not have NCLU privileges (either in the netshow or netedit group, or in the /etc/netd.conf file) runs an NCLU command, a traceback occurs instead of a permissions error. |
3.7.0-3.7.16, 4.0.0-4.4.5 | |
| 2539670 |
On the Edgecore 4610-54P switch, automatic medium-dependent interface crossover (auto-MDIX) stops working on a 100M full duplex interface and does not detect the required cable connection type. |
3.7.2-3.7.16, 4.0.0-4.4.5 | |
| 2539124 |
The net add interface command adds no ptm-enable for that interface in the frr.conf file. Running the net add or the net del command does not remove no ptm-enable from the frr.conf file. You have to remove it manually using vtysh. |
3.7.2-3.7.16, 4.0.0-4.4.5 | |
| 2539081 |
When you delete post-up and pre-down IP peer entries from the etc/network/interfaces file, then run the ifreload command, the IP addresses are not removed and the route remains in the route table. To work around this issue, either delete the IP addresses without the /32 mask component or flush the IP addresses for the interface with the ip addr flush dev command. |
3.7.0-3.7.16 | 4.0.0-4.4.5 |
| 2538875 |
IPv6 multicast traffic destined to an unregistered multicast group is flooded to all ports in a bridge despite the bridge.optimized_mcast_flood = TRUE setting in the /etc/cumulus/swichd.conf file. |
3.7.2-3.7.16 | |
| 2538790 |
NCLU automatically adds the VLAN ID (for the layer 3 VNI/SVI) to the bridge when you run net add vxlan . This configuration breaks network connectivity in an EVPN symmetric routing configuration using MLAG. To restore connectivity, remove the VLAN ID from the bridge. |
3.7.2-3.7.16, 4.0.0-4.4.5 | |
| 2538590 |
When you configure a control plane ACL to define permit and deny rules destined to the local switch, NCLU programs the control plane ACL rules into the FORWARD chain. |
3.7.2-3.7.16, 4.0.0-4.4.5 | |
| 2538562 |
On an RMP/1G-T switch, when you remove link-speed 100 with the NCLU command or by editing the etc/network/interfaces file to revert the 100M interface to the default (1G auto), the interface fails to recover and does not come back up.After you remove the link-speed, ethtool shows the advertised link modes as not reported and Speed/Duplex as unknown.To work around this issue and bring the interface back up, either restart switchd or use ethtool to configure the speed, advertised, duplex or MDI-X settings. Note: The advertised link mode gets set incorrectly if you include 1000baseT/Half. The port will come up successfully at 1G. |
3.7.2-3.7.16, 4.0.0-4.4.5 | |
| 2538302 |
portwd allows an error to change the module type based on the error. For example, a bad write to a module might cause the module type to flap, which causes the link itself to flap. |
3.7.0-3.7.16 | |
| 2538294 |
If you use NCLU to create an iBGP peering across the peer link, running the net add bgp l2vpn evpn neighbor peerlink.4094 activate command creates a new eBGP neighborship when one has already been configured for iBGP. This is unexpected; the existing iBGP configuration is valid. |
3.7.0-3.7.16, 4.0.0-4.4.5 | |
| 2538256 |
On the Broadcom switch, when a link-local multicast frame is received on an access port with a VNI in the bridge, two copies of the packet are sent across the VNI to remote VTEPs and the receiving hosts observe duplicate packets. |
3.7.2-4.0.1 | 4.1.0-4.4.5 |
| 2537819 |
When you enable FEC (RS or BaseR) on an interface, removing the configuration from that interface does not revert the FEC status to off/none. |
3.7.2-3.7.16 | 4.0.0-4.4.5 |
| 2537699 |
There is a limitation on the number of SVI interfaces you can specify as DHCP relay interfaces in the /etc/default/isc-dhcp-relay file. For example, 1500 SVI interfaces causes the dhcrelay service to exit without a core file and logs similar to the following are generated for the interfaces:
Eventually the dhcrelay service stops. |
3.7.1-3.7.16, 4.0.0-4.4.5 | |
| 2537544 |
When you run the mstpctl command, you might see the bridge-port state as blocking when it is actually disabled. You might see the same incorrect bridge-port state when other programs or tools use the output of mstpctl; for example, SNMP output from the BRIDGE-MIB. |
3.7.1-3.7.16, 4.0.0-4.4.5 | |
| 2537378 |
NCLU SNMPv3 user configuration (add, delete, modify) does not complete. Changes are made to the /etc/snmp/snmpd.conf file but the SNMPv3 user cache file /var/lib/snmp/snmpd.conf fails to update correctly and the configuration does not reflect in operation. To work around this issue, stop snmpd, remove the cache file, then restart snmpd. |
3.7.1-3.7.16 | |
| 2537188 |
When an event in the network, such as a switchd or networking service restart, leads to an OVSDB server high availability transition, an ovs-vtepd core might occur. This core generation has no effect on the functionality of high availability when the active OVSDB server is back in the network. |
3.7.2-3.7.16 | |
| 2537104 |
When you try to stop hsflowd on the Trident II+ switch with the systemctl stop hsflowd command, the process hangs until you stop it with SIGKILL. |
3.7.1-3.7.16 | 4.0.0-4.4.5 |
| 2537061 |
The Dell S5048F-ON switch (with reverse airflow, rear to front), shows the Temp-3 sensor as absent. |
3.7.1-4.0.1 | 4.1.0-4.4.5 |
| 2536608 |
Single tagged ARP requests received on a QinQ-over-VXLAN access port are dropped if ARP suppression is enabled on an unrelated VNI. |
3.7.0-3.7.16 | |
| 2536384 |
The BFD packet redirection logic used by OVSDB server high availability mode redirects BUM packets across the peer link. The iptables rule for redirection does differentiate between BFD and non-BFD VXLAN inner packets because the service node sends all frames with its own IP address as the tunnel source IP address. The VXLAN encapsulated BUM packets do not get forwarded to the CPU and do not go through the iptable redirection rule; only VXLAN encapsulated BFD packets get forwarded to the CPU due to the inner MAC DA lookup in hardware. |
3.7.0-3.7.16, 4.0.0-4.4.5 | |
| 2536179 |
On switches with the Trident 2+ ASIC, counters associated with VLANs and VRFs are not working. | 3.7.0-3.7.16, 4.0.0-4.4.5 | |
| 2535986 |
At a high CPU transmit traffic rate (for example, if there is unexpected CPU generated flooding or replication in software), when the ASIC packet driver cannot keep up with the transmit rate because there are no free DMA buffers, it can back pressure by suspending the switch port transmit queues. This can fill up the application socket buffers resulting in No buffer space available error messages on protocol sockets.When the driver recovers, it automatically resumes the transmit queues. In most cases these error messages are transient. In rare cases, the hardware queues might get stuck, which you can recover with a switchd restart. |
3.7.0-3.7.16, 4.0.0-4.4.5 | |
| 2535965 |
On the Trident3 switch, static PIM with IIF based on a layer 2 bridge does not work reliably. PIM Join via signaling is required for IPMC to work properly. To work around this issue, use dynamic signaling (joins) to manage IP multicast traffic. |
3.7.0-3.7.16, 4.0.0-4.4.5 | |
| 2533691 |
If you configure a VLAN under a VLAN-aware bridge and create a subinterface of the same VLAN on one of the bridge ports, the bridge and interface compete for the same VLAN and if the interface is flapped, it stops working. Correcting the configuration and running the ifreload command does not resolve the conflict. To work around this issue, correct the bridge VIDs and restart switchd or delete the subinterface. |
3.7.12-3.7.16, 4.0.0-4.4.5 | |
| 2532017 |
In FRR, bgp_snmp does not show all BGP peers when peer groups used. |
3.7.11-4.0.1 | 4.1.0-4.4.5 |
Fixed Issues in 3.7.14.2
| Issue ID | Description | Affects |
|---|---|---|
| 2556012 |
On Broadcom switches, after repeated VLAN or VXLAN configuration changes, switchd memory might not free up appropriately, which can lead to a crash. |
3.7.14, 4.0.0-4.2.1 |
| 2555494 |
On Broadcom switches, when WARN level switchd log messages are generated, switchd might crash resulting in a core file generated on the system. |
4.2.0-4.2.1 |
| 2555178 |
On Mellanox switches, the ASIC temperature sensor reading reports zeros. As a result, the fan speed is higher than normal. You can see the temperature reading in the output of the sensors command. |
3.7.14 |
| 2552214 |
The Mellanox SN2700 and SN2410 switch intermittently reports PSU fan state changes with Unable to read from device/fan1_input/pwm1 syslog messages. |
3.7.11-3.7.14, 4.1.1-4.3.0 |
3.7.14 Release Notes
Open Issues in 3.7.14
| Issue ID | Description | Affects | Fixed |
|---|---|---|---|
| 3410952 |
If MLAG is configured but disconnected from an MLAG peer for an extended period of time (days or more), there is a long delay (up to a minute per day) before traffic forwarding stabilizes after the MLAG peer connection re-establishes. | 3.7.0-4.3.1 | 4.3.2-4.4.5, 5.5.0-5.15.0 |
| 3376798 |
On Broadcom switches, Cumulus Linux does not create the hardware bridging domain for a traditional bridge with a VXLAN interface during switchd restart. The /var/log/switchd.log file includes the following exception logs shortly after switchd restarts:switchd[30158]: hal_bcm_l3.c:1617 find_egr_path_if_vxlan_overlay:vxlan overlay : nh PORT: port <#>, vlanMAC learning looks correct, but traffic does not flow as expected. |
3.7.0-4.3.1 | 4.3.2-4.4.5 |
| 3330705 |
When using TACACS+, a TACACS+ server name that returns more than one IP address, such as an IPv6 and IPv4 address, is counted many times against the limit of seven TACACS+ servers, which might cause some of the later listed servers to be ignored as over the limit. To work around this issue, you can set the prefer_ip_version configuration option (the default value is 4) to choose between an IPv4 or IPv6 address if both are present. |
3.7.0-5.3.1 | 5.4.0-5.15.0 |
| 3327477 |
If you use su to change to a user specified through TACACS+, the user becomes the local tacacs0 thru tacacs15 user instead of the named user to run sudo commands. As a result, the named user password might not match the local tacacs0 thru tacacs15 user password. |
3.7.0-3.7.16, 4.0.0-4.4.5, 5.0.0-5.15.0 | |
| 3216921 |
RADIUS authenticated users with read-only access to NCLU commands (users in the users_with_show list) can run edit commands if a username for a non-local account is on the users_with_edit line of the /etc/netd.conf file. To work around this issue, make sure that all usernames on the users_with_edit line of the /etc/netd.conf file are configured local users for the system (real Linux users) |
3.7.0-3.7.16, 4.3.0-4.4.5 | |
| 3209699 |
RADIUS authenticated users with read-only access to NCLU commands (users in the users_with_show list) can run edit commands if a username for a non-local account is on the users_with_edit line of the /etc/netd.conf file. To work around this issue, make sure that all usernames on the users_with_edit line of the /etc/netd.conf file are configured local users for the system (real Linux users) |
3.7.0-4.3.0, 4.4.0-5.2.1 | 4.3.1, 5.3.0-5.15.0 |
| 3135801 |
Zebra rejects MAC IP updates from BGP when the MAC mobility sequence number that BGP sends is lower than the sequence number known to zebra When the MAC mobility sequence that BGP knows legitimately lowers (due to narrow timing conditions during convergence or after rebooting an MLAG pair one VTEP at a time), zebra rejects these updates and maintains a stale state. If the stale information that zebra uses points to the wrong VTEP address, traffic goes to the wrong VTEP and might drop. |
3.7.12-4.3.0 | 4.3.1-4.4.5 |
| 3073668 |
On the EdgeCore AS4610 switch, when you change the speed of any of the SFP+ ports, the other SFP+ ports flap. | 3.7.12-3.7.16, 4.3.0-4.4.5 | |
| 3017190 |
When you power cycle the switch, multiple interfaces came up in a PoE disabled state To work around this issue, run the sudo poectl -a | grep disabled command to find ports with disabled POE. Run the sudo poectl -e swp1-swp48 command to enable POE on affected ports. |
3.7.10-3.7.16 | |
| 2940076 |
In a VXLAN fabric with ToR switches configured in a MLAG pair, BUM traffic received on a VXLAN tunnel is decapsulated and forwarded on the peer link bond. The BUM traffic is then encapsulated by the peer switch and sent back to the fabric. The issue has been seen in environments where the following conditions exist at the same time:1) high VNI scale2) switchd is busy processing updates3) clagd is in a transition state, such as Up, then Down, then Up. For example, when clagd restarts, the switch reboots, and so onThe problem is seen on the switch that experiences the clagd state transition. |
3.7.12-3.7.15 | 3.7.16 |
| 2940063 |
Under certain high scale conditions, various modules might experience timetouts during cl-support collection, which results in missing data in the cl-support file. | 3.7.12-3.7.15, 4.1.1-4.3.0 | 3.7.16, 4.3.1-4.4.5, 5.0.0-5.15.0 |
| 2934940 |
When you change the SVI vlan-id value in the /etc/network/interfaces file, then run ifreload -a, the 802.1Q ID for the SVI in the kernel does not change.This operation is not supported in the kernel without recreating the SVI. To apply the change, run ifdown, then ifup for the SVI to recreate the interface. |
3.7.13-4.2.1 | 4.3.0-4.4.5 |
| 2934939 |
When you configure BGP aggregate-address summary-only and any component route within the summary updates, all component routes within the summary update in the RIB on the device advertising the summary. This condition might result in increased CPU usageTo workaround this issue, remove the aggregate-address summary-only configuration, add a static route to Null0 for the prefix, and configure an outbound route map to restrict anything more specific than the desired prefix from being advertised. For example: Before:address-family ipv4 unicastAfter: ip route 10.10.0.0/16 Null0This example assumes no other static routes are present. Otherwise, you might need to configure additional route maps to limit the static routes being redistributed. |
3.7.12-3.7.16 | |
| 2866084 |
When you reboot a VTEP, MAC address entries might become out of sync between the kernel FDB table and the EVPN MAC VNI table on remote VTEPs. The impacted MAC entries are installed against the rebooted VTEP IP address in the kernel FDB and the correct VTEP IP is present in the EVPN MAC VNI table. To work around this issue, clear all corrupted MAC address entries in the kernel FDB with the bridge fdb del dev command, then add “vxlan-learning”: “off” in the /etc/network/ifupdown2/policy.d/vxlan.json file:$ cat /etc/network/ifupdown2/policy.d/vxlan.jsonReboot the affected switches. |
3.7.12-4.3.0 | 4.3.1-4.4.5 |
| 2866061 |
On the Maverick S4148T switch with MLAG, Cumulus Linux drops LACP, ARP, LLDP and BGP traffic. | 3.7.12-3.7.16 | |
| 2815592 |
In an EVPN configuration, an FRR restart on a border leaf VRRP master causes a stale route for the VRRP VIP on some remote VTEPs to point to the VRRP backup after convergence. | 3.7.12-3.7.15, 4.3.0, 4.4.2-5.0.1 | 3.7.16, 4.3.1, 5.1.0-5.15.0 |
| 2801262 |
On NVIDIA Spectrum ASICs in a layer 2 bridge scaled configuration (more than 800 VLANs), clagd.service enters a failed state after a reboot or a switchd restart. |
3.7.12-3.7.15, 4.3.0, 4.4.2-4.4.5 | 3.7.16, 4.3.1, 5.0.0-5.15.0 |
| 2794750 |
When a multipath route that contains an EVPN path exists together with an IPv4 BGP path in the VRF, the RMAC to VTEP binding is incorrect. This invalid entry occurs because Cumulus Linux treats IPv4 routes received over the eBGP IPv4 peering incorrectly in the VRF. To work around this issue, remove the unnecessary eBGP IPv4 peering. |
3.7.12-4.2.1 | 4.3.0-4.4.5 |
| 2736265 |
After an apt upgrade, the OPTIONS configuration line in /etc/default/isc-dhcp-relay might be removed. To work around this issue, reconfigure the desired options in the file after the upgrade completes. |
3.7.12-4.3.0 | 4.3.1-4.4.5, 4.4.0-4.4.5 |
| 2730225 |
When withdrawal and advertisement processing occurs in short succession, type-2 routes with an IP are not imported into layer 2 VNIs. | 3.7.12-4.3.0 | 4.3.1-4.4.5, 4.4.2-4.4.5 |
| 2700767 |
Following an event that causes the peerlink bond MAC address to change, such as a slave port state change, MLAG interfaces might be suspended due to a peer IP mismatch. This behavior is seen when you use a MLAG peer IP linklocal configuration. | 3.7.12-3.7.15, 4.3.0-4.4.5 | 3.7.16 |
| 2687332 |
When you configure BGP aggregate-address summary-only and any component route within the summary updates, all component routes within the summary update in the RIB on the device advertising the summary. This condition might result in increased CPU usageTo workaround this issue, remove the aggregate-address summary-only configuration, add a static route to Null0 for the prefix, and configure an outbound route map to restrict anything more specific than the desired prefix from being advertised. For example: Before:address-family ipv4 unicastAfter: ip route 10.10.0.0/16 Null0This example assumes no other static routes are present. Otherwise, you might need to configure additional route maps to limit the static routes being redistributed. |
3.7.12-4.2.1 | 4.3.0-4.4.5 |
| 2684452 |
When a VTEP is rebooted, MAC address entries might become out of sync between the kernel fdb table and the EVPN MAC VNI table on remote VTEPs. The impacted MAC entries will be installed against the rebooted VTEP IP in the kernel fdb and the correct VTEP IP will be present in the EVPN MAC VNI table You can work around this issue with the following steps:1. Clear all corrupted mac entries in the kernel FDB with the bridge fdb del dev command2. Add “vxlan-learning”: “off” under /etc/network/ifupdown2/policy.d/vxlan.json$ cat /etc/network/ifupdown2/policy.d/vxlan.json3. Reboot the affected switch(es) |
3.7.12-3.7.16 | |
| 2669438 |
Editing the /etc/frr/frr.conf file to add a new sequence at the beginning of an existing large prefix list changes the subsequent sequence numbers of the next entries in the list and FRR reload might fail with the error message frr.service reload operation timed out. Stopping. To work around this issue, instead of adding the new prefix using an existing sequence number and pushing other sequences forward, use a sequence number that is free; for example, instead of of using 5 -> 10 -> 15, use 5 -> 7 -> 10. |
3.7.11-3.7.16 | |
| 2660582 |
In an MLAG configuration, the secondary MLAG switch does not use a unique address instead of the MLAG system MAC address when there is a double failure (backup IP and peer link failure) To recover restart the clagd service with sudo systemctl restart clagd.service |
3.7.8-3.7.15 | 3.7.16 |
| 2653400 |
When 802.1x MAB and a parking VLAN are configured on an interface, hostapd might install a static fdb entry if the interface is down. To work around this issue, delete 802.1x from the interface with the net del interface command, then add back the 802.1x configuration. |
3.7.10-3.7.16 | |
| 2645846 |
When 802.1x MAB and a parking VLAN are configured on an interface, hostapd might install a static fdb entry if the interface is down. To work around this issue, delete 802.1x from the interface with the net del interface command, then add back the 802.1x configuration. |
3.7.10-3.7.15 | 3.7.16, 4.3.1-4.4.5 |
| 2638137 |
When you delete a static route using NCLU, the configuration is not deleted from the running configuration or from the /etc/frr/frr.conf file. |
3.7.13-3.7.16 | |
| 2633245 |
On the Dell N3048EP-ON switch, the SPF+ ports remain down after a power cycle. | 3.7.10-3.7.16 | |
| 2599607 |
In some corner cases, remote MAC entries may be seen as locally learnt entries in FDB table due to switchd reprogramming it | 3.7.12-4.3.0 | 4.3.1-4.4.5, 4.4.4-4.4.5, 5.0.0-5.15.0 |
| 2595889 |
In a traditional bridge configuration with ip-forward off, neighbors are synchronized to hardware with a switchd restart but are cleared when you flap the bridge interface. |
3.7.10-4.2.1 | 4.3.0-4.4.5 |
| 2595816 |
Tenant VRF BGP peers appear in the EVPN RMAC and nexthop tables, which causes the kernel RMAC to point at invalid IP address. | 3.7.12-4.2.1 | 4.3.0-4.4.5 |
| 2589747 |
If switchd successfully signals clagd that it is going down, clagd stops responding to keepalive echo requests from the peer instead of sending a good bye to the peer over both the peerlink and the backup switch. Eventually, the keepalive timer expires and the secondary switch becomes the primary, and brings the bonds and VNIs back up. However, if switchd does not successfully signal it is going down, (in the event of a crash), the primary switch continues to respond to keepalives, and the bonds and VNIs are down on both peers. |
3.7.12-4.2.1 | 4.3.0-4.4.5 |
| 2581473 |
When netq-agent is installed on the Dell N3048EP platform, switchd might crash if pluggables are installed in the SFP+ ports. | 3.7.13-3.7.15 | 3.7.16 |
| 2562511 |
hostapd does not fail over to secondary RADIUS servers for 802.1x authentication when the primary radius is reachable but not responding to Access-RequestsIf the primary RADIUS server is having a problem servicing requests, you can remove it from the configuration temporarily to force requests to be sent to alternate servers. |
3.7.10-3.7.14.2 | 3.7.15-3.7.16 |
| 2556815 |
When ARP suppression is enabled, RARP packets sometimes get dropped and are not flooded by the local VTEP. To work around this issue, disable ARP suppression. |
3.7.14-4.3.0 | 4.3.1-4.4.5, 4.4.0-4.4.5 |
| 2556763 |
In a configuration with both traditional and VLAN-aware bridges, the VLAN membership check on a VLAN-aware bridge does not drop PVST BPBUs that come from a traditional bridge. | 3.7.14-4.3.0 | 4.3.1-4.4.5, 4.4.0-4.4.5 |
| 2556233 |
Some ECMP next-hops might fail installation into hardware at high ECMP group and route scale. The following log message will be observed when this condition occurs:WARN xx routes reverted to non-ECMP due to NH table capacity |
3.7.9-3.7.14.2 | 3.7.15-3.7.16 |
| 2556037 |
After you add an interface to the bridge, an OSPF session flap might occur |
3.7.9-4.2.0 | 4.2.1-4.4.5 |
| 2556023 |
After upgrading Cumulus Linux with the apt-upgrade command, then rebooting an MLAG pair, if there are no bonds configured with a clag-id, the clagd service has difficulty peering, and holds all MLAG interfaces and VNIs in a proto down stateTo work around this issue, after upgrading both switches, restart the clagd service with the sudo systemctl restart clagd command on each MLAG pair. |
3.7.14-3.7.14.2 | 3.7.15-3.7.16 |
| 2556012 |
On Broadcom switches, after repeated VLAN or VXLAN configuration changes, switchd memory might not free up appropriately, which can lead to a crash. |
3.7.14-3.7.14.2, 4.0.0-4.2.1 | 3.7.15-3.7.16, 4.3.0-4.4.5 |
| 2555908 |
If the you add the MLAG backup IP address to the MLAG peer in the secondary role while the peer link is down, the LACP sys-mac does not use the MLAG system MAC address (clagd-sys-mac) when the peer link comes back up To work around this issue, wait until the peer link is up to add the MLAG backup IP address. To recover from this condition, restart clagd with the sudo systemctl restart clagd command. |
3.7.12-4.0.1 | 4.1.0-4.4.5 |
| 2555528 |
In an EVPN Active/Active configuration, when one of the peers reboots and begins to refresh IP neighbor entries shared by the MLAG peer, some of these ARP messages might be dropped by the MLAG peer’s ARP policer. To work around this issue, increase the burst value of the ARP policers to 200 or higher. |
3.7.14-4.2.1 | 4.3.0-4.4.5 |
| 2555401 |
On the Edgecore AS7312 switch, eth0 and swp use the same MAC address. | 3.7.14-4.2.1 | 4.3.0-4.4.5 |
| 2555278 |
When you change the anycast address for the MLAG pair (clagd-vxlan-anycast-ip), high peak traffic occurs on the peer link interface of all MLAG switches. | 3.7.13-3.7.16 | 4.0.0-4.4.5 |
| 2555178 |
On Mellanox switches, the ASIC temperature sensor reading reports zeros. As a result, the fan speed is higher than normal. You can see the temperature reading in the output of the sensors command. |
3.7.14-3.7.14.2 | 3.7.15-3.7.16 |
| 2554991 |
When running traditional mode bridges at scale (for example, when you have more than 200 bridges and a large number of MAC addresses), MLAG bonds flap intermittently from dual to single connected, then back to dual connected, which causes a layer 2 loop and STP state changes. To work around this issue, either shut down one side of the MLAG bond or prune out VLANS over the bond. |
3.7.13-4.2.1 | 4.3.0-4.4.5 |
| 2554804 |
On Mellanox SN2010 and SN2100 switches, the maximum fan speed is exceeded by fifteen percent. | 3.7.14-3.7.14.2 | 3.7.15-3.7.16 |
| 2554785 |
After you reboot a Broadcom switch, switchd might fail to restart and you see logs in switchd.log similar to the following:Nov 12 12:20:05.063876 leaf01 switchd[9867]:Nov 12 12:20:05.064310 leaf01 switchd[9867]: hal_bcm_console.c:294 0:system_init:Nov 12 12:20:05.064428 leaf01 switchd[9867]: hal_bcm_console.c:294 system_init: Misc init failed: Operation timed outNov 12 12:20:05.064464 leaf01 switchd[9867]:Nov 12 12:20:05.091995 leaf01 switchd[9867]: hal_bcm_console.c:294 LED: Loading 256 bytes into LED program memoryNov 12 12:20:05.092029 leaf01 switchd[9867]:Nov 12 12:20:05.099547 leaf01 switchd[9867]: hal_bcm_console.c:294 PORT: Error: bcm ports not initializedNov 12 12:20:05.099579 leaf01 switchd[9867]:Nov 12 12:20:05.099646 leaf01 switchd[9867]: hal_bcm_console.c:294 Error: file /var/lib/cumulus/rc.datapath_0: line 81 (error code -1): script terminatedNov 12 12:20:05.099667 leaf01 switchd[9867]:Nov 12 12:20:05.099775 leaf01 switchd[9867]: hal_bcm_console.c:294 Error: file /etc/bcm.d/rc.soc: line 70 (error code -1): script terminatedNov 12 12:20:05.099798 leaf01 switchd[9867]:Nov 12 12:20:05.099871 leaf01 switchd[9867]: hal_bcm_console.c:294 ERROR loading rc script on unit 0Nov 12 12:20:05.099892 leaf01 switchd[9867]:Nov 12 12:20:05.099943 leaf01 switchd[9867]: hal_bcm_console.c:299 CRIT loading of rc script failed, aborting!To work around this issue, configure Cumulus Linux to boot with the ntel_iommu=off kernel command option:1. Open the /etc/default/grub file with a text editor2. Edit the GRUB_CMDLINE_LINUX variable by adding the string intel_iommu=off at the end. For example: GRUB_CMDLINE_LINUX=“cl_platform=cel_e1031 console=ttyS1,115200n8 intel_iommu=off"3. Run the update-grub command4. Reboot the switch. |
3.7.11-4.2.1 | 4.3.0-4.4.5 |
| 2554719 |
A slow memory leak is observed (1% per 14 hours) in kmalloc-256. To work around this issue, reboot the switch. |
3.7.12-3.7.14.2 | 3.7.15-3.7.16 |
| 2554709 |
The IP address specified in the ip pim use-source command configured on the loopback interface should be inherited by unnumbered interfaces during their Primary IP address selection process. If ip pim use-source is configured on the loopback after an unnumbered interface has already selected their Primary IP address, the unnumbered interface does not update its Primary IP address to be the new use-source value until after there is a netlink update for that interface.To work around this issue, configure ip pim use-source on each unnumbered interface directly or ensure ip pim use-source is applied to the loopback before other unnumbered interfaces are enabled for PIM. |
3.7.13-3.7.16, 4.2.1-4.4.5 | |
| 2554588 |
If you try to reconfigure a DHCP server after you delete the switch configuration with the net del all command, the dhcpd service fails because a duplicate process is runningTo work around this issue, edit the /usr/lib/python2.7/dist-packages/nclu/plugins/dhcp.py file to change:DHCPD_PID="-pf {0}” to:DHCPD_PID="-pf {1}" |
3.7.13-4.2.1 | 4.3.0-4.4.5 |
| 2554369 |
Certain Dell S4048-ON switches show an incorrect vendor name and hang when you issue the reboot command. |
3.7.12-4.2.1 | 4.3.0-4.4.5 |
| 2554329 |
On the Dell N3248PXE switch, fixed RJ45 interfaces with PoE neighbors can end up in Paused mode after a switchd restart, which blocks traffic on that interface. |
3.7.12-3.7.16 | |
| 2553887 |
When using TACACS+ configured with a DEFAULT user providing privilege level lower than 16, TACACS+ configured users with privilege level 16 access might not be able to run privilege level 16 NCLU commands, such as net add and net del and see an error similar to the following:
To work around this issue, remove the DEFAULT user from the TACACS+ server. |
3.7.7-3.7.16, 4.0.0-4.4.5 | |
| 2553748 |
On switches with the Spectrum ASIC, the IPv6 default route is present in the kernel but missing in hardware. | 3.7.11-4.2.1 | 4.3.0-4.4.5 |
| 2553677 |
When you configure an SNMPv3 user with the net-snmp-config configuration command from the libsnmp-dev package, you get an error message similar to the one below:
To work around this issue, use the NCLU command to configure SNMPv3 user parameters; for example:
Alternatively, directly edit the /etc/snmp/snmpd.conf file as described in the documentation. |
3.7.13-3.7.16, 4.0.0-4.4.5 | |
| 2553219 |
You cannot configure SNMPv3 trap-destinations in non-default VRFs with an authentication username that contains fewer than eight characters. | 3.7.12-4.2.1 | 4.3.0-4.4.5 |
| 2553116 |
When you manually set the link speed or duplex mode with ethtool to an unsupported value, then run a TDR check against the interface, you encounter a switchd service heartbeat failure.To work around this issue, reboot the switch to clear the condition. Avoid setting the interface speed or duplex mode directly with ethtool. |
3.7.12-3.7.16, 4.0.0-4.4.5 | |
| 2553050 |
SNMP status might incorrectly reflect that a BGP neighbor is down due to an issue between bgpd and SNMP AgentX when the IP-FORWARD-MIB is also polled.To work around this issue, avoid polling IP-FORWARD-MIB objects. |
3.7.12-3.7.16 | |
| 2553015 |
If a neighbour contains a special character in PortID for LLDP, the net show interface command does not display the LLDP information or the command might fail. |
3.7.10-3.7.16, 4.2.0-4.4.5 | |
| 2552939 |
RX_DRP on a bond interface increases without any data traffic while the slave port does not increase. | 3.7.12-4.2.1 | 4.3.0-4.4.5 |
| 2552869 |
On the Dell N3048EP switch, the module information from SFP ports is not displayed in the l1-show command.To work around this issue, use the ethtool -m command. |
3.7.13-4.2.1 | 4.3.0-4.4.5 |
| 2552742 |
On the Mellanox SN2410 switch, you see switchd core and GBIN_MALLOC errors.To work around this issue, restart switchd. |
3.7.12-4.2.1 | 4.3.0-4.4.5 |
| 2552739 |
Counters for IPROUTER rules do not increase when traffic is forwarded to the CPU because there is no IP neighbor. | 3.7.2-3.7.16 | |
| 2552294 |
NCLU restarts FRR when removing a BGP VRF IPv4 aggregate-address command. |
3.7.12-3.7.16, 4.0.0-4.4.5 | |
| 2552214 |
The Mellanox SN2700 and SN2410 switch intermittently reports PSU fan state changes with Unable to read from device/fan1_input/pwm1 syslog messages. |
3.7.11-3.7.14.2, 4.1.1-4.3.0 | 3.7.15-3.7.16, 4.3.1-4.4.5, 4.4.0-4.4.5 |
| 2551911 |
ifupdown2 does not account for link status or link down configuration when running dhclient. For example, ifupdown2 ignores link-down yes during ifup/ifreload and runs the DHCP module if inet dhcp is configured on the interface. ifupdown2 also runs the DHCP module even when the physical link configured for DHCP is down. |
3.7.12-4.2.0 | 4.2.1-4.4.5 |
| 2551578 |
When you configure a bridge in the /etc/network/interfaces file, then try to reconfigure the bridge to be a VRF interface with the same name, ifreload/ifup commands fail with an invalid table id or unable to get vrf table id error. |
3.7.12-3.7.16, 4.0.0-4.4.5 | |
| 2551565 |
If you toggle VRRP priority values between VRRP routers, then restart switchd, a few IPv6 VRRP instances might not converge. As a result, both the VRRP routers act as master routers for the impacted IPv6 VRRP instances. IPv4 VRRP instances are not affectedTo work around this issue, remove, then add back the VRRP configuration with NCLU or vtysh commands. |
3.7.13-3.7.16, 4.2.0-4.4.5 | |
| 2551305 |
The net show configuration command provides the wrong net add command for ACL under the VLAN interface. |
3.7.12-3.7.16, 4.1.0-4.4.5 | |
| 2551288 |
When you remove BFD configuration by editing the /etc/frr/frr.conf file and restarting FRR, you see a traceback.To work around this issue, either use NCLU or vtysh commands to remove the BFD configuration, or restart FRR with the new /etc/frr/frr.conf file. |
3.7.7-3.7.16 | 4.0.0-4.4.5 |
| 2550974 |
On the Dell S3000 switch, after installing the Cumulus Linux 4.1.1 disk image without a license, the switch sends a link beat if a remote host port is configured. | 3.7.11-3.7.16, 4.1.1-4.4.5 | |
| 2550942 |
NCLU tab completion for net show displays the text add help text instead of system Information for the system option. |
3.7.11-4.2.0 | 4.2.1-4.4.5 |
| 2550796 |
On a Broadcom switch with the Trident2+ ASIC, ACL rules for VLANs are not applied after a reboot and the counters remain at zero. To work around this issue, either do not set acl.non_atomic_update_mode = TRUE in the /etc/cumulus/switchd.conf file or run the cl-acltool -i command after the reboot to install the ACLs. |
3.7.12-4.2.1 | 4.3.0-4.4.5 |
| 2550793 |
The NCLU net show bridge spanning-tree command displays the aging timer incorrectly. |
3.7.12-3.7.16, 4.0.0-4.4.5 | |
| 2550600 |
The received PVST BPDU for a VLAN is flooded even though the ingress port doesn’t have the VLAN tagged. | 3.7.8-3.7.14.2, 4.0.0-4.3.0 | 3.7.15-3.7.16, 4.3.1-4.4.5, 4.4.0-4.4.5 |
| 2550478 |
VXLAN interface as in-interface or out-interface in an ACL is not supported in Spectrum-based switches. | 3.7.7-4.2.0 | 4.2.1-4.4.5, 4.3.0-4.4.5 |
| 2550444 |
Tab completion for the net show rollback description command returns information about a snapshot instead of context help.To work around this issue, run the net show commit history command to find descriptions instead of the net show rollback description command. |
3.7.12-3.7.16, 4.0.0-4.4.5 | |
| 2550443 |
The net show rollback description command returns an error even if the string matches a commit description.To work around this issue, look for your string in the output of the net show commit history command (or grep for it there) instead. |
3.7.12-3.7.16, 4.0.0-4.4.5 | |
| 2550276 |
In LLDP, the snmp subagent loses all subsequent lldpRemSysName (1.0.8802.1.1.2.1.4.1.1.9) entries after an entry with a missing SysName is added.All the information from lldpctl is correct. Only the entries after the entry that is missing a SysName in lldpRemSysName disappear from the snmp subagent. |
3.7.12-4.2.1 | 4.3.0-4.4.5 |
| 2550243 |
When you use nginx and restserver in management VRF to provide a REST API for the switch, nginx starts but restserver fails to start.To work around this issue, comment out the Requires= line in the /lib/systemd/system/restserver.service. For example:
|
3.7.12-3.7.16, 4.0.0-4.4.5 | |
| 2550056 |
The ACCTON-DIAG option under the Cumulus Linux GRUB menu does not work. When you select this option, you see the following error:
|
3.7.12-3.7.16, 4.1.1-4.4.5 | |
| 2549925 |
When you run an Ansible script to replace the /etc/network/interfaces file, then run the ifreload -a command, you see errors similar to the following:
To work around this issue, run the ifreload -a command a second time. |
3.7.12-3.7.16, 4.0.0-4.4.5 | |
| 2549872 |
If you have an SVI with multiple VRR IP addresses and try to delete one of the VRR configurations, net commit or ifreload -a returns an error. |
3.7.12-3.7.16, 4.1.1-4.4.5 | |
| 2549838 |
In vtysh, if you configure, then remove a layer 3 VNI for a VRF, the VNI is removed from zebra even if the VNI interface still exists in the kernel. If you configure a layer 2 VNI as a layer 3 VNI by mistake, removing the layer 3 VNI binding removes it from zebra but EVPN-learned MACs and neighbors are not installed into the kernel. To work around this issue, delete, then re-add the missing VNI. For example:
If you flap the link with the ip link set vni10100 down; ip link set vni10100 up commands, zebra does not re-add the VNI. |
3.7.12-4.2.1 | 4.3.0-4.4.5 |
| 2549782 |
The JSON format output of the net show bgp l2vpn evpn summary command shows the incorrect neighbour state. |
3.7.12-3.7.16, 4.0.0-4.4.5 | |
| 2549731 |
When you create SPAN or ERSPAN rules in ebtables, the action fails to install if it is not in lowercase. Make sure that the SPAN or ERSPAN action is all lowercase; for example:
|
3.7.12-3.7.16, 4.1.1-4.4.5 | |
| 2549472 |
On switches with the Trident3 ASIC, PFC is not working as expected. If you set the PFC for only one CoS, pause frames are sent for all CoS traffic. | 3.7.11-4.1.1 | 4.2.0-4.4.5 |
| 2549371 |
When Optimized Multicast Flooding (OMF) is enabled with the bridge.optimized_mcast_flood = TRUE setting in the /etc/cumulus/switchd.conf file, the switch continues to flood IPv6 multicast traffic to all slave ports when there is no MLD join receive. |
3.7.11-4.3.3 | 4.4.0-4.4.5 |
| 2549226 |
You might see the following gport error messages in switchd.log:
These messages are harmless and can be ignored. |
3.7.12-4.2.1 | 4.3.0-4.4.5 |
| 2548962 |
With FRR or OSPF, you might see an inconsistent link-state advertisement. For example, when you configure the OSPF default originate route as metric-type 1 with a specific metric, Cumulus Linux shows the default originate route as an external metric-type 2 route with the default metric in the database. This issue typically occurs when both IPv4 and IPv6 default routes exist in the routing table. | 3.7.12-4.1.1 | 4.2.0-4.4.5 |
| 2548930 |
On Mellanox Spectrum switches that contain an OSPF IP unnumbered neighborship with a high scale of prefixes being learned, a link flap might cause the neighbor entry to not be programmed in hardware. | 3.7.11-4.2.1 | 4.3.0-4.4.5 |
| 2548746 |
On the Broadcom switch with the Trident3 ASIC, packet priority remark values assigned from each internal CoS value continue to work with default values; if you change the internal CoS value, the change does not take effect. | 3.7.11-4.1.1 | 4.2.0-4.4.5 |
| 2548657 |
When you upgrade Cumulus Linux on the EdgeCore AS7726-32X or AS7326-56X switch, you might see firmware errors similar to the following:
You can safely ignore these error messages. |
3.7.12-3.7.16, 4.0.0-4.4.5 | |
| 2548490 |
A change in a route map prefix list that should remove a route might not be reflected in the ospf6 database or in peers, and the route might not be deleted. To work around this issue, reenter the redistribute <connected|static> route-map statement in the configuration. |
3.7.11-4.1.1 | 4.2.0-4.4.5 |
| 2548485 |
If you configure the aggregate-address summary-only option before injecting a component of the same aggregate into the BGP table with the network or redistribute command, when you remove the aggregate-address configuration, the component stays suppressed; it is not advertised to peers. For example:Existing configuration:router bgp 1If you add network 50.0.0.1/32, you see the following (expected) BGP table entries:Status codes: s suppressed, d damped, h history, * valid, > best, = multipath,Removing aggregate-address 50.0.0.0/8 summary-only at this point results in the following (unexpected) BGP table entry:Status codes: s suppressed, d damped, h history, * valid, > best, = multipath,To work around this issue, remove, then re-add the component prefix routes. |
3.7.12-4.2.1 | 4.3.0-4.4.5 |
| 2548243 |
On switches with the Trident2+ ASIC, adding SPAN rules disables PBR rules. | 3.7.3-3.7.16, 4.0.0-4.4.5 | |
| 2548155 |
The net show bgp neighbor swpX json command shows negative output for the bgpTimerUpMsec timer. |
3.7.10-3.7.16 | 4.0.0-4.4.5 |
| 2548117 |
In OVSDB traditional bridge mode, adding or removing a VLAN binding causes a traffic forwarding outage for around 20 seconds or more on adjacent VLAN bindings. Cumulus Linux does not support traditional bridge mode with VMware NSX. | 3.7.12-3.7.16, 4.0.0-4.4.5 | |
| 2548044 |
When a remote VTEP withdraws a type-3 EVPN route, Cumulus Linux purges all MAC address and neighbor entries installed in the corresponding layer 2 VNI through that remote VTEP from the local EVPN and kernel forwarding tables. This purge occurs even if the remote VTEP does not withdraw type-2 routes carrying the MAC address or neighbor entries. The entries stay missing from the local EVPN and kernel forwarding tables until BGP updates the MAC address and neighbor. | 3.7.12-3.7.15, 4.0.0-4.4.5 | 3.7.16 |
| 2548024 |
On the Dell Z9100 switch, 100G-SR4 modules might not link up reliably in certain ports. swp1, 2, 3, 9, 10, 23, 24, 30, 31, and 32 might be affected To work around this issue, move 100G SR4 modules to one of the ports not affected by this issue. |
3.7.11-4.1.1 | 4.2.0-4.4.5 |
| 2547942 |
On the Lenovo NE0152T switch, one power supply (PSU2) always show as ABSENT in smonctl. | 3.7.11-4.0.1 | 4.1.0-4.4.5 |
| 2547839 |
When you try to configure link-down on a parent interface of a subinterface configured in a VRF, you encounter an error. |
3.7.11-4.1.1 | 4.2.0-4.4.5 |
| 2547782 |
If a LLDP neighbor advertises a PortDescr that contains commas, ptmctl -d splits the string on the commas and misplaces its components in other columns. |
3.7.11-3.7.16, 4.0.0-4.4.5 | |
| 2547706 |
When you configure ganged ports in the ports.conf file, the change does not take effect after you restart switchd. To work around this issue, reboot the switch. |
3.7.11-3.7.16, 4.0.0-4.4.5 | |
| 2547659 |
On the EdgeCore AS7326-56X switch, the default fan speed, which is defined in the thermal specification, results in excessive fan noise. | 3.7.11-4.0.1 | 4.1.0-4.4.5 |
| 2547573 |
On Tomahawk switches, when the vxlan_tnl_arp_punt_disable option is set to FALSE, ARP packets are not forwarded to the CPU. |
3.7.9-3.7.16 | |
| 2547443 |
On the Dell N3248PXE-ON switch, 25G SFP ports do not work in 10G mode. | 3.7.11-4.0.1 | 4.1.0-4.4.5 |
| 2547381 |
The hsflowd service sends an undefined header protocol 0 in the sampled flow sample to the collector, which is not recognized by the sFlow tool. You see errors similar to the following:
|
3.7.11-3.7.16 | 4.0.0-4.4.5 |
| 2547349 |
When you change an interface IP address, then change it back, static routes are misprogrammed One of the following actions recovers the routes:- Bounce both layer 3 interfaces- Remove or add static routes in FRR- Restart FRR |
3.7.11-3.7.16 | 4.0.0-4.4.5 |
| 2547123 |
On the Broadcom switch with the Trident3 ASC, packet priority remark values assigned from each internal CoS value continue to work with default values; if you change the internal CoS value, the change does not take effect. | 3.7.11-4.1.1 | 4.2.0-4.4.5 |
| 2547120 |
After you hot swap a PSU, the decode-syseeprom -t psuX command shows the old PSU information (such as the serial number), until you run the decode-syseeprom –init command. |
3.7.11-3.7.16, 4.0.0-4.4.5 | |
| 2547100 |
On switches with the Trident3 ASIC, PFC is not working as expected. If you set the PFC for only one CoS, pause frames are sent for all CoS traffic. | 3.7.11-4.1.1 | 4.2.0-4.4.5 |
| 2547068 |
Hardware platforms using the Intel D-1500 CPU series might reboot unexpectedly To work around this issue, contact your hardware vendor to inquire if a new version of BIOS with a microcode fix is available or manually disable CPU C-states in the kernel as outlined below To permanently disable C-states using a kernel boot parameter:1. Edit /etc/default/grub to add the argument processor.max_cstate=0 to the variable GRUB_CMDLINE_LINUX. For example, if /etc/default/grub file contains the line GRUB_CMDLINE_LINUX=“cl_platform=accton_as7726_32x console=tty0 console=ttyS0,115200n8 intel_iommu=off pcie_aspm=off”, change it to GRUB_CMDLINE_LINUX=“cl_platform=accton_as7726_32x console=tty0 console=ttyS0,115200n8 intel_iommu=off pcie_aspm=off processor.max_cstate=0”2. Run sudo update-grub3. Reboot the system with sudo rebootTo disable cstates in realtime on the current system, which does not persist through a reboot:1. Confirm that the libpci3 package is installed. Run dpkg-query -l libpci3 and confirm the following line is displayed:ii libpci3:amd64 1:3.2.1-3 amd64 Linux PCI Utilities (shared library)The first field above should read ii. If not, install the libpci3 package by running sudo apt upgrade;sudo apt install libpci32. Disable C-states by running the command ./cpupower idle-set -d 2C-states are disabled by default in Cumulus Linux 4.3.0 and later. |
3.7.9-4.2.1 | 4.3.0-4.4.5 |
| 2546991 |
The FRR service does not provide a way for automation to know if the configuration applied properly. To work around this issue, execute the vtysh -f command in the automation file before starting the FRR service to validate the functional configuration and return an error code. |
3.7.11-3.7.16, 4.0.0-4.4.5 | |
| 2546895 |
If you have configured a higher number of ports and VLANs (ports x VLANs) or the switch is a lower-powered (CPU) platform, the switchd service might fail to send a systemd keepalive within the watchdog timeout value (2 minutes by default) and you see an error similar to the following:bq. systemd[1]: switchd.service watchdog timeout (limit 2min)!To workaround this issue, either reduce the number of configured interfaces and, or VLANs, or increase the systemd timeout for switchd.serviceTo increase the systemd timeout:1.Edit the /etc/systemd/system/switchd.service.d/override.conf file and increase the WatchdogSec parameter2.Restart the switchd service with the sudo systemctl restart switchd.service commandsystemd attempts to restart the switchd service automatically (after the watchdog timeout). If the restart fails multiple times in a short time period, run the sudo systemctl reset-failed command followed by the sudo systemctl restart switchd command. |
3.7.11-3.7.16, 4.0.0-4.4.5 | |
| 2546450 |
On the EdgeCore AS7326-56X switch, you might see the RPM of certain fans run over the maximum threshold. | 3.7.11-3.7.16 | |
| 2546385 |
SNMP ifLastChange reports link transitions when there are none. | 3.7.6-3.7.16 | |
| 2546225 |
When you execute the following command on the Delta AG6248C switch, the switch reboots and then comes right back into Cumulus Linux without installing the new image. The install image is still in /var/lib/cumulus/installer, which causes issues with cl-support.
To work around this issue, use the onie-select command to access ONIE, and then use the nos-install command in ONIE to install a new binary image. |
3.7.11-3.7.16, 4.0.0-4.4.5 | |
| 2546203 |
When using QinQ with a traditional bridge, if you enable the LLDP dot1 TLV option, you see the following suboptimal behavior: * Both the inner and outer VLAN information is sent as part of VLAN TLVs in the LLDP packet. * If the outer VLAN ID is the same as the inner VLAN ID, only one VLAN TLV is sent with that VLAN ID in the LLDP packet. |
3.7.11-3.7.16 | |
| 2546131 |
On the Delta AG-6248C PoE switch, when you run the apt upgrade command, the upgrade does not work. Cumulus Linux uses uboot directly instead of grub to boot the kernel. Uboot needs a special header to boot the kernel, which is not present. Without this header, when you use the apt upgrade command to upgrade Linux packages, uboot is unable to boot up the kernel. To work around this issue, upgrade Cumulus Linux by installing the Cumulus Linux image. Run the onie-select command to go into ONIE, and then use the nos-install command in ONIE to install a new image.This workaround only works when an out-of-band network is present. |
3.7.11-3.7.16, 4.0.0-4.4.5 | |
| 2546010 |
When hal.bcm.per_vlan_router_mac_lookup is set to TRUE in the /etc/cumulus/switchd.conf file, inter-VLAN traffic is forwarded to the CPU when associated VNI interfaces exist. |
3.7.10-3.7.16 | |
| 2545997 |
The NCLU command net show interface produces an error if bonds with no members exist.To work around this issue, remove the empty Bond interfaces from the /etc/network/interfaces file and run sudo ifreload -a. |
3.7.10-3.7.16 | |
| 2545566 |
The Dell Z9100-ON switch incorrectly reports many sensors as ABSENT. | 3.7.12-4.0.1 | 4.1.0-4.4.5 |
| 2545446 |
If you use NCLU commands to add a non-MLAG bond, then add an MLAG configuration, the net commit command fails. However, a subsequent net commit command succeeds. |
3.7.10-3.7.16 | |
| 2545125 |
If you configure more than one VRR interface on an SVI interface, deleting one of the VRR addresses does not remove the interface/address. | 3.7.10-3.7.16, 4.0.0-4.4.5 | |
| 2544978 |
If you delete an undefined bond, then add a bond slave, the net commit command fails. |
3.7.9-3.7.16, 4.0.0-4.4.5 | |
| 2544968 |
FRR configuration commands for an SVI interface might have the \n misplaced in the output. For example:
should be:
To work around this issue, configure the interface manually in the /etc/frr/frr.conf file. |
3.7.9-3.7.16, 4.0.0-4.4.5 | |
| 2544953 |
When you update the hostname of a switch with the NCLU net add hostname command, then run net commit, the lldpd service does not restart and other devices still see the old hostname.To work around this issue, run the sudo systemctl restart lldpd.service command. |
3.7.10-3.7.16, 4.0.0-4.4.5 | |
| 2544904 |
After you delete an IPv6 numbered BGP peer group neighbor, Cumulus Linux might continue to send route advertisements. To work around this issue, restart FRR after removing the IPv6 numbered configuration. |
3.7.9-4.1.1 | 4.2.0-4.4.5 |
| 2544829 |
Frames received with a VLAN tag of 0 on an interface configured as a bridge port and forwarded to the CPU for processing might appear tagged with the native VLAN when viewed with tcpdump. |
3.7.8-3.7.16 | |
| 2544556 |
If you reconfigure an NTP server with NCLU using different trailing options after the IP address (such as iburst), an invalid configuration is added to the /etc/ntp.conf file. For example:
If you need to alter existing server configurations, first remove the server, commit, then re-add the server with any trailing options. |
3.7.9-4.1.1 | 4.2.0-4.4.5 |
| 2544463 |
Auto-negotiation does not work with the QSFP28 cables and a remote system operating at 10G. Attempting to enable auto-negotiation with ethtool -s swp<#> autoneg on returns Operation not supported.To work around this issue, do not use auto-negotiation and set the local port speed to 10G. |
3.7.9-3.7.16, 4.0.0-4.4.5 | |
| 2544456 |
The NCLU net show lldp command displays the speed of a ganged port group as the speed of one of the individual links, rather than the sum of their speeds. |
3.7.9-3.7.16, 4.0.0-4.4.5 | |
| 2544311 |
Applying a policy-based routing (PBR) rule for all traffic from a host might disrupt ARP refresh for that connected host. | 3.7.5-3.7.16, 4.0.0-4.4.5 | |
| 2544155 |
NCLU requires you to specify an interface with multiple address-virtual statements in ascending MAC address order. |
3.7.5-3.7.16, 4.0.0-4.4.5 | |
| 2544113 |
Mac learning is not disabled by default on a double tagged peer link interface resulting in the MAC address changing between the MLAG bond and the peer link. To work around this issue, disable MAC learning on QinQ VLANs by adding bridge-learning off to the VLAN stanza in the etc/network/interfaces file. |
3.7.9-3.7.16, 4.0.0-4.4.5 | |
| 2543900 |
On the Mellanox switch, static VXLAN tunnels incorrectly allow traffic from any remote tunnel IP address. | 3.7.8-3.7.16, 4.0.0-4.4.5 | |
| 2543841 |
The net show evpn vni detail json command includes an extra empty dictionary at the end of the output. |
3.7.8-3.7.16, 4.0.0-4.4.5 | |
| 2543840 |
On the Mellanox SN2700 switch, you cannot enable resilient hashing (RASH) and set the bucket size to 64 in the traffic.conf file. |
3.7.6-3.7.16 | |
| 2543800 |
When local-tunnelip is an SVI, the static VXLAN tunnel does not work; the next hop router receives the packet but drops it as it does not know where to forward the packet. The static VXLAN tunnel does works if local-tunnelip is a loopback or a physical layer 3 interface. |
3.7.8-3.7.16 | 4.0.0-4.4.5 |
| 2543647 |
ERSPAN in ebtables does not work for VNIs. For example, the following rule does not work:
|
3.7.6-4.2.1 | 4.3.0-4.4.5 |
| 2543646 |
In an ebtables rule, ERSPAN (upper case) does not work. You need to specify erspan (lower case). | 3.7.6-3.7.16, 4.0.0-4.4.5 | |
| 2543627 |
Tomahawk 40G DACs cannot disable auto-negotiation. | 3.7.7-3.7.16 | 4.0.0-4.4.5 |
| 2543270 |
The default route injected through OSPF when you configure default-information originate always is unreliable and might age out unexpectedly.To work around this issue, rely on a different source of default route other than injection with default-information originate. |
3.7.8-4.1.1 | 4.2.0-4.4.5 |
| 2543211 |
In some cases, the switchd service might warn of excessive MAC moves from one switch port to itself (for example, from swp18 to swp18). |
3.7.0-3.7.16, 4.0.0-4.4.5 | |
| 2543164 |
The MTU of an SVI cannot be higher than the MTU on the bridge. Changing the MTU on the SVI with NCLU does not update the bridge MTU. The net commit command succeeds even though the MTU is not changed as expected.To work around this issue, change the MTU on all SVIs and the bridge manually in the /etc/network/interfaces file, then apply the change with the ifreload -a command. |
3.7.7-3.7.16, 4.0.0-4.4.5 | |
| 2543096 |
When an SVI with a virtual MAC is configured with a layer 2 VNI in an EVPN environment, if you replace the /etc/network/interfaces file with a different file that does not have the SVI and layer 2 VNI configuration, the original virtual MAC is not populated through the EVPN route until FRR is restarted. |
3.7.6-3.7.16, 4.0.0-4.4.5 | |
| 2543058 |
The IP neighbor entry for a link-local next hop is not installed by FRR, which results in a forwarding failure for routes via that next hop. This is a rare problem that occurs with IPv4 route exchange over IPv6 GUA peering with no IPv4 addresses on the interfaces. To work around this issue, flap the peering to the peer router (which might be a route reflector) to recover. To avoid this issue, configure IPv6 router advertisements on the connecting interfaces. |
3.7.7-3.7.16 | 4.0.0-4.4.5 |
| 2543052 |
Received EVPN type-5 and type-2 MACIP routes are not installed in the kernel (and hardware) routing tables for the associated VRF, which causes traffic to be blackholed. The failure to install the default route causes complete reachability failure for the particular tenant on the affected racks. The routes that are not installed are seen as “inactive” in the routing subsystem (FRR) VRF routing table. This problem is rare and can occur only in EVPN configurations that have user-configured route targets (RTs) for tenant VRFs, and only following a restart of FRR. To work around this issue, either restart the FRR service on the affected switch with the sudo systemctl restart frr.service command or bounce the layer 3 SVI for the affected VRF; for example:
You can run the net show vrf vni command to print a mapping of VRF : L3-VNI : L3-SVI. |
3.7.5-3.7.16 | 4.0.0-4.4.5 |
| 2543044 |
Under certain conditions, EVPN next hops might not be removed when the contributing peer goes down or might not be populated when the BGP session to the contributing peer comes up. You can prevent EVPN next hops from not being removed when the contributing peer goes down by specifying static MAC addresses on all layer 3 VNIs. There is no workaround for preventing EVPN next hops from not being populated when the BGP session to the contributing peer comes up. |
3.7.2-3.7.16 | 4.0.0-4.4.5 |
| 2542979 |
On the Dell-N3048EP-ON switch, when you run the sudo -E apt upgrade command, the upgrade does not work. |
3.7.7-4.1.1 | 4.2.0-4.4.5 |
| 2542945 |
On the Broadcom Maverick switch with a QinQ configuration, the packets coming into the CPU might be tagged incorrectly; for example, 802.1ad + 802.1q tags are expected in the packets but the packets have 802.1q + 802.1q tags. To work around this issue, configure the bridge with bridge-vlan-protocol 802.1ad:
|
3.7.6-3.7.16, 4.0.0-4.4.5 | |
| 2542310 |
hsflow disregards the setting for agent.cidr in the /etc/hsflowd.conf file and selects an IPv6 agent address. The source IP address of the hsflowd packet is IPv4, but the agent address in the hsflow payload shows IPv6. |
3.7.6-3.7.16 | |
| 2542305 |
If an SVI exists in the configuration before you assign it an IP address, when you do assign the IP address with the NCLU command, the vlan-id and the raw-device bridge stanzas are not added automatically. |
3.7.6-3.7.16, 4.0.0-4.4.5 | |
| 2542301 |
When first creating a bond and enslaving an interface, NCLU hides some of the bridge command suggestions, although they are still accepted. |
3.7.3-3.7.16, 4.0.0-4.4.5 | |
| 2541212 |
The maximum-prefix configuration under the IPv4 address family has an optional restart value, which you can configure. This configuration is ignored and, instead of restarting the sessions every x minutes, the peer constantly changes between established and idle due to the prefix count being exceeded. |
3.7.5-3.7.16, 4.0.0-4.4.5 | |
| 2541165 |
On the Dell N3048EP-ON switch, UPOE is supported only on ports 1 thru 12. (UPOE uses all four pairs of standard Ethernet cabling whereas PoE delivers power over two twisted pairs.) When you plug a UPOE device in a port higher than port 12, poectl reports that four_pair_mode_enabled is true. However, this configuration is not supported on the port so poectl should report that four_pair_mode_enabled is false. |
3.7.6-3.7.16 | |
| 2541029 |
On switches with the Trident2 ASIC, 802.1Q-encapsulated control plane traffic received on an interface with 802.1AD configured subinterfaces might be dropped. This issue only affects QinQ configurations. |
3.7.5-3.7.16, 4.0.0-4.4.5 | |
| 2540950 |
On the QuantaMesh T4048-IX8 or EdgeCore AS7326-56X switch, when using a 1000BASE-T SFP module, the module LEDs do not light to reflect link status. |
3.7.3-4.1.1 | 4.2.0-4.4.5 |
| 2540885 |
The Dell N3048EP-ON switch does not support 1G Base-T modules in the SFP ports. | 3.7.7-3.7.16 | |
| 2540863 |
On the EdgeCore AS5812-54X switch, the PSU2 Fan1 fluctuates between OK and LOW. When the fan speed is reported as LOW, the RPM is shown as a negative number. |
3.7.3-3.7.16 | |
| 2540753 |
If the interface alias contains a single or double quotation mark, or an apostrophe, the net show configuration commands fail with the following error:
|
3.7.5-3.7.16, 4.0.0-4.4.5 | |
| 2540444 |
SNMP incorrectly requires engine ID specification. |
3.7.4-3.7.16, 4.0.0-4.4.5 | |
| 2540352 |
When you use NCLU to configure a route map, the parser allows for glob matching of interfaces for a match interface condition when there can only be a single interface matched. The proper syntax is to use multiple route map clauses, each matching a single interface, instead of a single clause matching multiple interfaces. For example, this command is incorrect:
These commands are correct:
|
3.7.2-3.7.16, 4.0.0-4.4.5 | |
| 2540340 |
NCLU allows for the configuration of addresses on VRF interfaces, but tab completion for the net add vrf command just displays
Tab completion for the net add vrf command works correctly. |
3.7.4-3.7.16, 4.0.0-4.4.5 | |
| 2540274 |
On the Maverick switch, CPU forwarded packets might be dropped when there is no route to a leaked host route. | 3.7.5-3.7.16, 4.0.0-4.4.5 | |
| 2540204 |
When links come up after FRR is started, VRF connected routes do not get redistributed. | 3.7.4-3.7.16, 4.0.0-4.4.5 | |
| 2540192 |
The net del bridge bridge mcsnoop yes command does not return the value to the default of disabled. To work around this issue, use the net add bridge bridge mcsnoop no command to delete the mcsnoop attribute and return to the default value. |
3.7.4-3.7.16, 4.0.0-4.4.5 | |
| 2540155 |
On the Broadcom switch, when moving configuration from bridged to routed (or toggling from routed to bridged to routed), some traffic is not seen by the kernel. This can cause BGP to not establish on a transit node. |
3.7.3-3.7.16, 4.0.0-4.4.5 | |
| 2540042 |
When you try to configure the VRRP priority and advertisement-interval with NCLU on a traditional mode bridge, the net commit command fails. To work around this issue, use the vtysh command (inside FRR) to change the VRRP priority or advertisement-interval on traditional bridges. For example:
|
3.7.4-3.7.16, 4.0.0-4.4.5 | |
| 2540041 |
On SVIs in a VLAN-aware bridge, you cannot change the VRRP priority with NCLU. To work around this issue, run the vtysh command inside FRR to change the default priority. For example:
|
3.7.4-3.7.16, 4.0.0-4.4.5 | |
| 2540040 |
Cumulus Linux uses VRRPv3 as the default version, and enables both preempt and accept mode by default. You cannot change these default values with NCLU. To work around this issue, run the vtysh commands (inside FRR) to change the default values. For example:
|
3.7.4-3.7.16, 4.0.0-4.4.5 | |
| 2540031 |
NCLU does not honor auto all in the /etc/network/interfaces file and removes the existing configuration if no individual auto lines exist. |
3.7.3-3.7.16, 4.0.0-4.4.5 | |
| 2539994 |
When you try to remove a BGP peer group configuration with NCLU, the command fails but no warning message is shown. For example:
|
3.7.2-3.7.16, 4.0.0-4.4.5 | |
| 2539962 |
When an LDAP user that does not have NCLU privileges (either in the netshow or netedit group, or in the /etc/netd.conf file) runs an NCLU command, a traceback occurs instead of a permissions error. |
3.7.0-3.7.16, 4.0.0-4.4.5 | |
| 2539670 |
On the Edgecore 4610-54P switch, automatic medium-dependent interface crossover (auto-MDIX) stops working on a 100M full duplex interface and does not detect the required cable connection type. |
3.7.2-3.7.16, 4.0.0-4.4.5 | |
| 2539124 |
The net add interface command adds no ptm-enable for that interface in the frr.conf file. Running the net add or the net del command does not remove no ptm-enable from the frr.conf file. You have to remove it manually using vtysh. |
3.7.2-3.7.16, 4.0.0-4.4.5 | |
| 2539081 |
When you delete post-up and pre-down IP peer entries from the etc/network/interfaces file, then run the ifreload command, the IP addresses are not removed and the route remains in the route table. To work around this issue, either delete the IP addresses without the /32 mask component or flush the IP addresses for the interface with the ip addr flush dev command. |
3.7.0-3.7.16 | 4.0.0-4.4.5 |
| 2538875 |
IPv6 multicast traffic destined to an unregistered multicast group is flooded to all ports in a bridge despite the bridge.optimized_mcast_flood = TRUE setting in the /etc/cumulus/swichd.conf file. |
3.7.2-3.7.16 | |
| 2538790 |
NCLU automatically adds the VLAN ID (for the layer 3 VNI/SVI) to the bridge when you run net add vxlan . This configuration breaks network connectivity in an EVPN symmetric routing configuration using MLAG. To restore connectivity, remove the VLAN ID from the bridge. |
3.7.2-3.7.16, 4.0.0-4.4.5 | |
| 2538590 |
When you configure a control plane ACL to define permit and deny rules destined to the local switch, NCLU programs the control plane ACL rules into the FORWARD chain. |
3.7.2-3.7.16, 4.0.0-4.4.5 | |
| 2538562 |
On an RMP/1G-T switch, when you remove link-speed 100 with the NCLU command or by editing the etc/network/interfaces file to revert the 100M interface to the default (1G auto), the interface fails to recover and does not come back up.After you remove the link-speed, ethtool shows the advertised link modes as not reported and Speed/Duplex as unknown.To work around this issue and bring the interface back up, either restart switchd or use ethtool to configure the speed, advertised, duplex or MDI-X settings. Note: The advertised link mode gets set incorrectly if you include 1000baseT/Half. The port will come up successfully at 1G. |
3.7.2-3.7.16, 4.0.0-4.4.5 | |
| 2538302 |
portwd allows an error to change the module type based on the error. For example, a bad write to a module might cause the module type to flap, which causes the link itself to flap. |
3.7.0-3.7.16 | |
| 2538294 |
If you use NCLU to create an iBGP peering across the peer link, running the net add bgp l2vpn evpn neighbor peerlink.4094 activate command creates a new eBGP neighborship when one has already been configured for iBGP. This is unexpected; the existing iBGP configuration is valid. |
3.7.0-3.7.16, 4.0.0-4.4.5 | |
| 2538256 |
On the Broadcom switch, when a link-local multicast frame is received on an access port with a VNI in the bridge, two copies of the packet are sent across the VNI to remote VTEPs and the receiving hosts observe duplicate packets. |
3.7.2-4.0.1 | 4.1.0-4.4.5 |
| 2537819 |
When you enable FEC (RS or BaseR) on an interface, removing the configuration from that interface does not revert the FEC status to off/none. |
3.7.2-3.7.16 | 4.0.0-4.4.5 |
| 2537699 |
There is a limitation on the number of SVI interfaces you can specify as DHCP relay interfaces in the /etc/default/isc-dhcp-relay file. For example, 1500 SVI interfaces causes the dhcrelay service to exit without a core file and logs similar to the following are generated for the interfaces:
Eventually the dhcrelay service stops. |
3.7.1-3.7.16, 4.0.0-4.4.5 | |
| 2537544 |
When you run the mstpctl command, you might see the bridge-port state as blocking when it is actually disabled. You might see the same incorrect bridge-port state when other programs or tools use the output of mstpctl; for example, SNMP output from the BRIDGE-MIB. |
3.7.1-3.7.16, 4.0.0-4.4.5 | |
| 2537378 |
NCLU SNMPv3 user configuration (add, delete, modify) does not complete. Changes are made to the /etc/snmp/snmpd.conf file but the SNMPv3 user cache file /var/lib/snmp/snmpd.conf fails to update correctly and the configuration does not reflect in operation. To work around this issue, stop snmpd, remove the cache file, then restart snmpd. |
3.7.1-3.7.16 | |
| 2537188 |
When an event in the network, such as a switchd or networking service restart, leads to an OVSDB server high availability transition, an ovs-vtepd core might occur. This core generation has no effect on the functionality of high availability when the active OVSDB server is back in the network. |
3.7.2-3.7.16 | |
| 2537104 |
When you try to stop hsflowd on the Trident II+ switch with the systemctl stop hsflowd command, the process hangs until you stop it with SIGKILL. |
3.7.1-3.7.16 | 4.0.0-4.4.5 |
| 2537061 |
The Dell S5048F-ON switch (with reverse airflow, rear to front), shows the Temp-3 sensor as absent. |
3.7.1-4.0.1 | 4.1.0-4.4.5 |
| 2536608 |
Single tagged ARP requests received on a QinQ-over-VXLAN access port are dropped if ARP suppression is enabled on an unrelated VNI. |
3.7.0-3.7.16 | |
| 2536384 |
The BFD packet redirection logic used by OVSDB server high availability mode redirects BUM packets across the peer link. The iptables rule for redirection does differentiate between BFD and non-BFD VXLAN inner packets because the service node sends all frames with its own IP address as the tunnel source IP address. The VXLAN encapsulated BUM packets do not get forwarded to the CPU and do not go through the iptable redirection rule; only VXLAN encapsulated BFD packets get forwarded to the CPU due to the inner MAC DA lookup in hardware. |
3.7.0-3.7.16, 4.0.0-4.4.5 | |
| 2536179 |
On switches with the Trident 2+ ASIC, counters associated with VLANs and VRFs are not working. | 3.7.0-3.7.16, 4.0.0-4.4.5 | |
| 2535986 |
At a high CPU transmit traffic rate (for example, if there is unexpected CPU generated flooding or replication in software), when the ASIC packet driver cannot keep up with the transmit rate because there are no free DMA buffers, it can back pressure by suspending the switch port transmit queues. This can fill up the application socket buffers resulting in No buffer space available error messages on protocol sockets.When the driver recovers, it automatically resumes the transmit queues. In most cases these error messages are transient. In rare cases, the hardware queues might get stuck, which you can recover with a switchd restart. |
3.7.0-3.7.16, 4.0.0-4.4.5 | |
| 2535965 |
On the Trident3 switch, static PIM with IIF based on a layer 2 bridge does not work reliably. PIM Join via signaling is required for IPMC to work properly. To work around this issue, use dynamic signaling (joins) to manage IP multicast traffic. |
3.7.0-3.7.16, 4.0.0-4.4.5 | |
| 2533691 |
If you configure a VLAN under a VLAN-aware bridge and create a subinterface of the same VLAN on one of the bridge ports, the bridge and interface compete for the same VLAN and if the interface is flapped, it stops working. Correcting the configuration and running the ifreload command does not resolve the conflict. To work around this issue, correct the bridge VIDs and restart switchd or delete the subinterface. |
3.7.12-3.7.16, 4.0.0-4.4.5 | |
| 2532017 |
In FRR, bgp_snmp does not show all BGP peers when peer groups used. |
3.7.11-4.0.1 | 4.1.0-4.4.5 |
Fixed Issues in 3.7.14
| Issue ID | Description | Affects |
|---|---|---|
| 2556019 |
After you add an interface to a bridge using the NCLU net add bridge bridge ports command, the bridge can go down and its MAC address changesTo work around this issue, use Linux commands to add an interface to a bridge. |
3.7.9-3.7.13 |
| 2554332 |
In an EVPN active/active environment, when one of the peers reboots and begins to refresh IP neighbor entries shared by the MLAG peer, some of the ARP messages might be dropped by the ARP policer of the MLAG peer. To work around this issue, increase the burst value of the ARP policers to 200 or higher. |
|
| 2554232 |
VXLAN encapsulated traffic is not routed to the next hop because the destination VTEP IP address is mis-programmed on the switch, which decapsulates the traffic unexpectedly. To work around this issue, restart switchd. |
3.7.12-3.7.13 |
| 2553732 |
A ping via a dual-connected bond fails, and the audio stream is not routed or encapsulated through the layer 3 VNI. | 3.7.12-3.7.13, 4.0.0-4.2.1 |
| 2553588 |
Multicast traffic on a VPN is sent to remote VTEPs that are not part of the VPN and the remote VTEPs receive multicast traffic encapsulated in a VXLAN ID that doesn’t exist. To work around this issue, disable IGMP snooping on the switch. |
3.7.12-3.7.13, 4.0.0-4.2.1 |
| 2553530 |
In an MLAG configuration with a layer 3 VNI, when you bounce the peer link, all layer 2 VNIs listed under the layer 3 VNI are duplicated. To work around this issue, restart FRR with the sudo systemctl restart frr.service command. |
3.7.10-3.7.13, 4.1.1-4.2.1 |
| 2553450 |
On the the Dell N3248-PXE switch, when you insert two PSUs at different times, the newly inserted PSU is detected as OK but the fan and temp sensors are ABSENT. To work around this issue, remove power to both PSUs at the same time, then reinsert power simultaneously. |
3.7.12-3.7.13, 4.2.1 |
| 2553229 |
On the Dell N3248PXE switch, RJ45 fixed copper ports that auto-negotiate with a 100M or 10M neighbor incorrectly negotiate a half-duplex link that generates errors. Half duplex modes are not supported on this platform. | 3.7.12-3.7.13, 4.2.1 |
| 2553001 |
When the following conditions exist, clagd might fail to establish a TCP control session across the subinterface (such as, peerlink.4094): * clagd uses an IPv6 link-local address (LLA) to establish the TCP connection (the clagd-peer-ip linklocal command configures an IPv6 LLA connection)* Subsequent VLAN changes are made to VLAN sub-interfaces or adding or removing SVIs This issue occurs because the hardware stores one entry per VRF to represent the IPv6 LLA. The hardware entry for the LLA is removed when another interface is changed because the software interfaces are represented by a single entity in hardware. As a result, packets destined to the local IPv6 LLA address are received on the port but do not get forwarded to CPU for further processing. To workaround this issue, use IPv4 addresses under peerlink.4094 and configure clagd to peer on IPv4 addresses. |
3.7.12-3.7.13 |
| 2552925 |
On the EdgeCore AS-6712-32X, AS5812-54X and AS5812-54T switch models, the temp sensors (DIMM temp sensor) show ABSENT. The amber diagnostic light on the front of the switch might also be turned on due to this issue. These messages and the light are cosmetic issues only and do not otherwise impact the function of the switch. |
3.7.12-3.7.13 |
| 2552881 |
IPv6 TCP or UDP connections (sourcing from an ephemeral port in the range 34048 to 35071) are not forwarded if the switch has more than one layer 2 VNI defined. The traffic might be locally switched on the bridge and dropped. To work around this issue, disable ARP/ND suppression to remove the internal ACL rule that affects the ports. |
3.7.13, 4.2.1 |
| 2552859 |
Mellanox switches with the Spectrum ASIC fail to read PSU Fan/Temp sensors and report them as Absent. The following messages are observed in syslog:
|
3.7.13 |
| 2552647 |
When you add a member to a bond that has a subinterface configured (such as peerlink.4094), the new member is assigned only the VLAN of the subinterface for forwarding. To work around this issue, bounce the bond or shutdown the new interface and use the remaining members over the bond. |
3.7.10-3.7.13, 4.2.0 |
| 2552528 |
Ingress SPAN/ERSPAN does not mirror packets when the next hop is EVPN encapsulated. | 3.7.7-3.7.13, 4.0.0-4.2.1 |
| 2552506 |
Changing the order of the bridge ports might cause the bridge MAC address to change, which flaps the bridge and its ports. To work around this issue, manually set the MAC address of the bridge interface by adding hwaddress to the bridge stanza in the /etc/network/interfaces file. |
3.7.11-3.7.13, 4.0.0-4.2.0 |
| 2552301 |
On a Mellanox switch with the Spectrum ASIC, you see LPC I2C driver errors similar to the following during boot:
|
3.7.13 |
| 2552205 |
If the MAC address of an SVI changes, clagd does not update its permanent neighbor entry for the local interface, and it does not report the change to its MLAG peer. This leaves the MLAG peer in a state where its permanent neighbor for the MLAG peer’s SVI IP address continues to use the old MAC address, which causes routed traffic over this SVI to be dropped.To work around this issue, ifdown/ifup the SVI when a MAC address changes. |
3.7.12-3.7.13, 4.0.0-4.2.0 |
| 2551748 |
In OVSDB high availability mode, deleting > 200 VLAN bindings might cause ovs-vtepd to crash. Limit the deletion to 200 or fewer VLAN bindings. |
3.7.12-3.7.13, 4.0.0-4.2.1 |
| 2551731 |
When the OVSDB VTEP scale increases, the CPU utilization increases and eventually the switch (ptmd) fails to respond to the BFD, causing the BFD session to go down. As a result OVSDB cannot read the BFD socket status and outputs a warning in the ovs-vtepd debugs: PTM socket error: Bad file descriptor. |
3.7.12-3.7.13, 4.0.0-4.2.0 |
| 2551728 |
In OVSDB high availability mode, if you create, then delete a binding, the FDB entry is not replaced and you see an error. | 3.7.12-3.7.13, 4.0.0-4.2.0 |
| 2551714 |
There is a change to the default OVSDB bootstrapping process, where the script created now defaults to VLAN-aware bridge mode. If you want to use traditional bride mode, you need to force it by editing the ovs-vtep-ctl script generated by the bootstrap process. |
3.7.12-3.7.13, 4.0.0-4.2.0 |
| 2551693 |
A host migrated to an 802.1X MAB port within the same broadcast domain fails to have the correct FDB entry installed if a dynamic FDB entry for that MAC address exists from previous connectivity in the broadcast domain. To work around this issue, manually delete the dynamic FDB entry that is associated with the uplink trunk port. |
3.7.12-3.7.13, 4.1.1-4.2.0 |
| 2551675 |
When you restart clagd, the edge port setting on the peer link changes. |
3.7.2-3.7.13, 4.0.0-4.2.0 |
| 2551651 |
The net show dot1x interface summary command output shows a MAC address with all zeros associated with a port. |
3.7.12-3.7.13, 4.0.0-4.2.0 |
| 2550873 |
In an MLAG configuration with static VXLAN, static tunnels become unreachable. | 3.7.13, 4.1.1-4.2.0 |
| 2550606 |
A VRRP role change over the EVPN network causes excessive BGP updates and connectivity issues to VIP for about one minute. | 4.1.1-4.2.0 |
| 2550375 |
CPU utilization may increase when clag-managed bond interfaces are operationally/LACP down but the physical carrier remains up on the bond member switchports. This condition occurs when clag bond redirection is enabled and bond members remain up while the parent bond does not negotiate LACP. This issue is resolved in Cumulus Linux 3.7.14. |
3.7.9-3.7.13, 4.0.0-4.2.1 |
| 2550350 |
Unicast traffic from downlink hosts is flooded to multiple remote VTEPs, which might also cause high HwIfOutQDrops/TX_DRP on the uplink ports. To work around this issue, restart switchd. |
3.7.10-3.7.13, 4.0.0-4.1.1 |
| 2549794 |
The asic-monitor.service fails when you configure /etc/cumulus/datapath/monitor.conf with monitor.histogram_pg.collect.port_group_list = [all_packet_pg] and there is traffic passing through the buffer. When the service fails, you see the following traceback in journalctl:
|
3.7.11-3.7.13, 4.1.1-4.2.0 |
| 2548475 |
After you add a new VNI and a layer 3 SVI to a set of leafs, certain leafs might not be able to communicate on the layer 3 VNI. To work around this issue, reboot the leaf switch or restart switchd. |
3.7.6-3.7.13 |
| 2548152 |
On the Mellanox Spectrum switch in an EVPN symmetric configuration with MLAG, simultaneously shutting down the layer 3 interfaces that serve as uplinks to the VXLAN fabric might result in traffic loss of up to 15 seconds. | 4.1.0-4.1.1 |
| 2547799 |
An error similar to the following shows in syslog for Mellanox switches:
To work around this issue, reboot the switch. |
3.7.11-3.7.13, 4.0.0-4.0.1 |
| 2547784 |
PTM mis-detects incorrect hostnames of LLDP neighbors and does not fail them as expected. Instead they end up in an N/A cabling status. | 3.7.11-3.7.13, 4.0.0-4.1.1 |
| 2547341 |
When host-resources and ucd-snmp-mib are polled, you see permission denied messages similar to the following:
|
3.7.13, 4.0.0-4.1.1 |
| 2547246 |
The MLAG switch pair has VLANs defined that are not used on MLAG bonds. These VLANs still synchronize MAC addresses across to the peer switch. This results in log messages that indicate a MAC address is installed and the VLAN is not defined; for example:
|
3.7.10-3.7.13, 4.0.0-4.1.1 |
| 2546577 |
A traditional bridge with QinQ and a VNI does not work for tagged traffic. | 3.7.10-3.7.13, 4.0.0-4.0.1 |
| 2545934 |
Mellanox switches might experience higher CPU usage from the sx_sdk service or when BFD is in use.To work around this issue, disable BFD to alleviate some of the CPU load. |
3.7.13, 4.0.0-4.1.1 |
| 2545699 |
On the Celestica Pebble switch, if you use IPv6 routes with mask /65 to /127, the switchd log fills with errors. |
3.7.10-3.7.13 |
| 2545537 |
On the Mellanox switch with the Spectrum and Spectrum-2 ASIC, IPv6 egress ACLs are not supported on subinterfaces. | 4.0.0-4.1.1 |
| 2545404 |
On the Trident3 switch, unicast ARP packets received on a VNI and forwarded to the CPU are not policed. | 3.7.10-3.7.13, 4.0.0-4.0.1 |
| 2535707 |
On the Mellanox switch, GRE tunneling does not work if the tunnel source is configured on an SVI interface. If the tunnel source is configured on a physical switch port, then tunneling works as expected. | 4.0.0-4.1.1 |
| 2534978 |
On the Mellanox switch, the destination MAC address of ERSPAN GRE packets is set to all zeros; therefore, the first transit switch might drop packets. | 4.0.0-4.2.1 |
| 2529322 |
On a Mellanox switch in an MLAG configuration, routed packets that arrive on one switch to be forwarded to a destination MAC across the peer link are dropped due to MLAG loop prevention. This affects both routed unicast and multicast packets. To work around this issue, modify the routing design or policy such that routes do not have a next hop of an MLAG peer switch that traverses the MLAG peer link. |
3.7.13 Release Notes
Open Issues in 3.7.13
| Issue ID | Description | Affects | Fixed |
|---|---|---|---|
| 3410952 |
If MLAG is configured but disconnected from an MLAG peer for an extended period of time (days or more), there is a long delay (up to a minute per day) before traffic forwarding stabilizes after the MLAG peer connection re-establishes. | 3.7.0-4.3.1 | 4.3.2-4.4.5, 5.5.0-5.15.0 |
| 3376798 |
On Broadcom switches, Cumulus Linux does not create the hardware bridging domain for a traditional bridge with a VXLAN interface during switchd restart. The /var/log/switchd.log file includes the following exception logs shortly after switchd restarts:switchd[30158]: hal_bcm_l3.c:1617 find_egr_path_if_vxlan_overlay:vxlan overlay : nh PORT: port <#>, vlanMAC learning looks correct, but traffic does not flow as expected. |
3.7.0-4.3.1 | 4.3.2-4.4.5 |
| 3330705 |
When using TACACS+, a TACACS+ server name that returns more than one IP address, such as an IPv6 and IPv4 address, is counted many times against the limit of seven TACACS+ servers, which might cause some of the later listed servers to be ignored as over the limit. To work around this issue, you can set the prefer_ip_version configuration option (the default value is 4) to choose between an IPv4 or IPv6 address if both are present. |
3.7.0-5.3.1 | 5.4.0-5.15.0 |
| 3327477 |
If you use su to change to a user specified through TACACS+, the user becomes the local tacacs0 thru tacacs15 user instead of the named user to run sudo commands. As a result, the named user password might not match the local tacacs0 thru tacacs15 user password. |
3.7.0-3.7.16, 4.0.0-4.4.5, 5.0.0-5.15.0 | |
| 3216921 |
RADIUS authenticated users with read-only access to NCLU commands (users in the users_with_show list) can run edit commands if a username for a non-local account is on the users_with_edit line of the /etc/netd.conf file. To work around this issue, make sure that all usernames on the users_with_edit line of the /etc/netd.conf file are configured local users for the system (real Linux users) |
3.7.0-3.7.16, 4.3.0-4.4.5 | |
| 3209699 |
RADIUS authenticated users with read-only access to NCLU commands (users in the users_with_show list) can run edit commands if a username for a non-local account is on the users_with_edit line of the /etc/netd.conf file. To work around this issue, make sure that all usernames on the users_with_edit line of the /etc/netd.conf file are configured local users for the system (real Linux users) |
3.7.0-4.3.0, 4.4.0-5.2.1 | 4.3.1, 5.3.0-5.15.0 |
| 3135801 |
Zebra rejects MAC IP updates from BGP when the MAC mobility sequence number that BGP sends is lower than the sequence number known to zebra When the MAC mobility sequence that BGP knows legitimately lowers (due to narrow timing conditions during convergence or after rebooting an MLAG pair one VTEP at a time), zebra rejects these updates and maintains a stale state. If the stale information that zebra uses points to the wrong VTEP address, traffic goes to the wrong VTEP and might drop. |
3.7.12-4.3.0 | 4.3.1-4.4.5 |
| 3073668 |
On the EdgeCore AS4610 switch, when you change the speed of any of the SFP+ ports, the other SFP+ ports flap. | 3.7.12-3.7.16, 4.3.0-4.4.5 | |
| 3017190 |
When you power cycle the switch, multiple interfaces came up in a PoE disabled state To work around this issue, run the sudo poectl -a | grep disabled command to find ports with disabled POE. Run the sudo poectl -e swp1-swp48 command to enable POE on affected ports. |
3.7.10-3.7.16 | |
| 2940076 |
In a VXLAN fabric with ToR switches configured in a MLAG pair, BUM traffic received on a VXLAN tunnel is decapsulated and forwarded on the peer link bond. The BUM traffic is then encapsulated by the peer switch and sent back to the fabric. The issue has been seen in environments where the following conditions exist at the same time:1) high VNI scale2) switchd is busy processing updates3) clagd is in a transition state, such as Up, then Down, then Up. For example, when clagd restarts, the switch reboots, and so onThe problem is seen on the switch that experiences the clagd state transition. |
3.7.12-3.7.15 | 3.7.16 |
| 2940063 |
Under certain high scale conditions, various modules might experience timetouts during cl-support collection, which results in missing data in the cl-support file. | 3.7.12-3.7.15, 4.1.1-4.3.0 | 3.7.16, 4.3.1-4.4.5, 5.0.0-5.15.0 |
| 2934940 |
When you change the SVI vlan-id value in the /etc/network/interfaces file, then run ifreload -a, the 802.1Q ID for the SVI in the kernel does not change.This operation is not supported in the kernel without recreating the SVI. To apply the change, run ifdown, then ifup for the SVI to recreate the interface. |
3.7.13-4.2.1 | 4.3.0-4.4.5 |
| 2934939 |
When you configure BGP aggregate-address summary-only and any component route within the summary updates, all component routes within the summary update in the RIB on the device advertising the summary. This condition might result in increased CPU usageTo workaround this issue, remove the aggregate-address summary-only configuration, add a static route to Null0 for the prefix, and configure an outbound route map to restrict anything more specific than the desired prefix from being advertised. For example: Before:address-family ipv4 unicastAfter: ip route 10.10.0.0/16 Null0This example assumes no other static routes are present. Otherwise, you might need to configure additional route maps to limit the static routes being redistributed. |
3.7.12-3.7.16 | |
| 2866084 |
When you reboot a VTEP, MAC address entries might become out of sync between the kernel FDB table and the EVPN MAC VNI table on remote VTEPs. The impacted MAC entries are installed against the rebooted VTEP IP address in the kernel FDB and the correct VTEP IP is present in the EVPN MAC VNI table. To work around this issue, clear all corrupted MAC address entries in the kernel FDB with the bridge fdb del dev command, then add “vxlan-learning”: “off” in the /etc/network/ifupdown2/policy.d/vxlan.json file:$ cat /etc/network/ifupdown2/policy.d/vxlan.jsonReboot the affected switches. |
3.7.12-4.3.0 | 4.3.1-4.4.5 |
| 2866061 |
On the Maverick S4148T switch with MLAG, Cumulus Linux drops LACP, ARP, LLDP and BGP traffic. | 3.7.12-3.7.16 | |
| 2815592 |
In an EVPN configuration, an FRR restart on a border leaf VRRP master causes a stale route for the VRRP VIP on some remote VTEPs to point to the VRRP backup after convergence. | 3.7.12-3.7.15, 4.3.0, 4.4.2-5.0.1 | 3.7.16, 4.3.1, 5.1.0-5.15.0 |
| 2801262 |
On NVIDIA Spectrum ASICs in a layer 2 bridge scaled configuration (more than 800 VLANs), clagd.service enters a failed state after a reboot or a switchd restart. |
3.7.12-3.7.15, 4.3.0, 4.4.2-4.4.5 | 3.7.16, 4.3.1, 5.0.0-5.15.0 |
| 2794750 |
When a multipath route that contains an EVPN path exists together with an IPv4 BGP path in the VRF, the RMAC to VTEP binding is incorrect. This invalid entry occurs because Cumulus Linux treats IPv4 routes received over the eBGP IPv4 peering incorrectly in the VRF. To work around this issue, remove the unnecessary eBGP IPv4 peering. |
3.7.12-4.2.1 | 4.3.0-4.4.5 |
| 2736265 |
After an apt upgrade, the OPTIONS configuration line in /etc/default/isc-dhcp-relay might be removed. To work around this issue, reconfigure the desired options in the file after the upgrade completes. |
3.7.12-4.3.0 | 4.3.1-4.4.5, 4.4.0-4.4.5 |
| 2730225 |
When withdrawal and advertisement processing occurs in short succession, type-2 routes with an IP are not imported into layer 2 VNIs. | 3.7.12-4.3.0 | 4.3.1-4.4.5, 4.4.2-4.4.5 |
| 2700767 |
Following an event that causes the peerlink bond MAC address to change, such as a slave port state change, MLAG interfaces might be suspended due to a peer IP mismatch. This behavior is seen when you use a MLAG peer IP linklocal configuration. | 3.7.12-3.7.15, 4.3.0-4.4.5 | 3.7.16 |
| 2687332 |
When you configure BGP aggregate-address summary-only and any component route within the summary updates, all component routes within the summary update in the RIB on the device advertising the summary. This condition might result in increased CPU usageTo workaround this issue, remove the aggregate-address summary-only configuration, add a static route to Null0 for the prefix, and configure an outbound route map to restrict anything more specific than the desired prefix from being advertised. For example: Before:address-family ipv4 unicastAfter: ip route 10.10.0.0/16 Null0This example assumes no other static routes are present. Otherwise, you might need to configure additional route maps to limit the static routes being redistributed. |
3.7.12-4.2.1 | 4.3.0-4.4.5 |
| 2684452 |
When a VTEP is rebooted, MAC address entries might become out of sync between the kernel fdb table and the EVPN MAC VNI table on remote VTEPs. The impacted MAC entries will be installed against the rebooted VTEP IP in the kernel fdb and the correct VTEP IP will be present in the EVPN MAC VNI table You can work around this issue with the following steps:1. Clear all corrupted mac entries in the kernel FDB with the bridge fdb del dev command2. Add “vxlan-learning”: “off” under /etc/network/ifupdown2/policy.d/vxlan.json$ cat /etc/network/ifupdown2/policy.d/vxlan.json3. Reboot the affected switch(es) |
3.7.12-3.7.16 | |
| 2669438 |
Editing the /etc/frr/frr.conf file to add a new sequence at the beginning of an existing large prefix list changes the subsequent sequence numbers of the next entries in the list and FRR reload might fail with the error message frr.service reload operation timed out. Stopping. To work around this issue, instead of adding the new prefix using an existing sequence number and pushing other sequences forward, use a sequence number that is free; for example, instead of of using 5 -> 10 -> 15, use 5 -> 7 -> 10. |
3.7.11-3.7.16 | |
| 2660582 |
In an MLAG configuration, the secondary MLAG switch does not use a unique address instead of the MLAG system MAC address when there is a double failure (backup IP and peer link failure) To recover restart the clagd service with sudo systemctl restart clagd.service |
3.7.8-3.7.15 | 3.7.16 |
| 2653400 |
When 802.1x MAB and a parking VLAN are configured on an interface, hostapd might install a static fdb entry if the interface is down. To work around this issue, delete 802.1x from the interface with the net del interface command, then add back the 802.1x configuration. |
3.7.10-3.7.16 | |
| 2645846 |
When 802.1x MAB and a parking VLAN are configured on an interface, hostapd might install a static fdb entry if the interface is down. To work around this issue, delete 802.1x from the interface with the net del interface command, then add back the 802.1x configuration. |
3.7.10-3.7.15 | 3.7.16, 4.3.1-4.4.5 |
| 2638137 |
When you delete a static route using NCLU, the configuration is not deleted from the running configuration or from the /etc/frr/frr.conf file. |
3.7.13-3.7.16 | |
| 2633245 |
On the Dell N3048EP-ON switch, the SPF+ ports remain down after a power cycle. | 3.7.10-3.7.16 | |
| 2599607 |
In some corner cases, remote MAC entries may be seen as locally learnt entries in FDB table due to switchd reprogramming it | 3.7.12-4.3.0 | 4.3.1-4.4.5, 4.4.4-4.4.5, 5.0.0-5.15.0 |
| 2595889 |
In a traditional bridge configuration with ip-forward off, neighbors are synchronized to hardware with a switchd restart but are cleared when you flap the bridge interface. |
3.7.10-4.2.1 | 4.3.0-4.4.5 |
| 2595816 |
Tenant VRF BGP peers appear in the EVPN RMAC and nexthop tables, which causes the kernel RMAC to point at invalid IP address. | 3.7.12-4.2.1 | 4.3.0-4.4.5 |
| 2589747 |
If switchd successfully signals clagd that it is going down, clagd stops responding to keepalive echo requests from the peer instead of sending a good bye to the peer over both the peerlink and the backup switch. Eventually, the keepalive timer expires and the secondary switch becomes the primary, and brings the bonds and VNIs back up. However, if switchd does not successfully signal it is going down, (in the event of a crash), the primary switch continues to respond to keepalives, and the bonds and VNIs are down on both peers. |
3.7.12-4.2.1 | 4.3.0-4.4.5 |
| 2581473 |
When netq-agent is installed on the Dell N3048EP platform, switchd might crash if pluggables are installed in the SFP+ ports. | 3.7.13-3.7.15 | 3.7.16 |
| 2562511 |
hostapd does not fail over to secondary RADIUS servers for 802.1x authentication when the primary radius is reachable but not responding to Access-RequestsIf the primary RADIUS server is having a problem servicing requests, you can remove it from the configuration temporarily to force requests to be sent to alternate servers. |
3.7.10-3.7.14.2 | 3.7.15-3.7.16 |
| 2556233 |
Some ECMP next-hops might fail installation into hardware at high ECMP group and route scale. The following log message will be observed when this condition occurs:WARN xx routes reverted to non-ECMP due to NH table capacity |
3.7.9-3.7.14.2 | 3.7.15-3.7.16 |
| 2556037 |
After you add an interface to the bridge, an OSPF session flap might occur |
3.7.9-4.2.0 | 4.2.1-4.4.5 |
| 2556019 |
After you add an interface to a bridge using the NCLU net add bridge bridge ports command, the bridge can go down and its MAC address changesTo work around this issue, use Linux commands to add an interface to a bridge. |
3.7.9-3.7.13 | 3.7.14-3.7.16 |
| 2555908 |
If the you add the MLAG backup IP address to the MLAG peer in the secondary role while the peer link is down, the LACP sys-mac does not use the MLAG system MAC address (clagd-sys-mac) when the peer link comes back up To work around this issue, wait until the peer link is up to add the MLAG backup IP address. To recover from this condition, restart clagd with the sudo systemctl restart clagd command. |
3.7.12-4.0.1 | 4.1.0-4.4.5 |
| 2555278 |
When you change the anycast address for the MLAG pair (clagd-vxlan-anycast-ip), high peak traffic occurs on the peer link interface of all MLAG switches. | 3.7.13-3.7.16 | 4.0.0-4.4.5 |
| 2554991 |
When running traditional mode bridges at scale (for example, when you have more than 200 bridges and a large number of MAC addresses), MLAG bonds flap intermittently from dual to single connected, then back to dual connected, which causes a layer 2 loop and STP state changes. To work around this issue, either shut down one side of the MLAG bond or prune out VLANS over the bond. |
3.7.13-4.2.1 | 4.3.0-4.4.5 |
| 2554785 |
After you reboot a Broadcom switch, switchd might fail to restart and you see logs in switchd.log similar to the following:Nov 12 12:20:05.063876 leaf01 switchd[9867]:Nov 12 12:20:05.064310 leaf01 switchd[9867]: hal_bcm_console.c:294 0:system_init:Nov 12 12:20:05.064428 leaf01 switchd[9867]: hal_bcm_console.c:294 system_init: Misc init failed: Operation timed outNov 12 12:20:05.064464 leaf01 switchd[9867]:Nov 12 12:20:05.091995 leaf01 switchd[9867]: hal_bcm_console.c:294 LED: Loading 256 bytes into LED program memoryNov 12 12:20:05.092029 leaf01 switchd[9867]:Nov 12 12:20:05.099547 leaf01 switchd[9867]: hal_bcm_console.c:294 PORT: Error: bcm ports not initializedNov 12 12:20:05.099579 leaf01 switchd[9867]:Nov 12 12:20:05.099646 leaf01 switchd[9867]: hal_bcm_console.c:294 Error: file /var/lib/cumulus/rc.datapath_0: line 81 (error code -1): script terminatedNov 12 12:20:05.099667 leaf01 switchd[9867]:Nov 12 12:20:05.099775 leaf01 switchd[9867]: hal_bcm_console.c:294 Error: file /etc/bcm.d/rc.soc: line 70 (error code -1): script terminatedNov 12 12:20:05.099798 leaf01 switchd[9867]:Nov 12 12:20:05.099871 leaf01 switchd[9867]: hal_bcm_console.c:294 ERROR loading rc script on unit 0Nov 12 12:20:05.099892 leaf01 switchd[9867]:Nov 12 12:20:05.099943 leaf01 switchd[9867]: hal_bcm_console.c:299 CRIT loading of rc script failed, aborting!To work around this issue, configure Cumulus Linux to boot with the ntel_iommu=off kernel command option:1. Open the /etc/default/grub file with a text editor2. Edit the GRUB_CMDLINE_LINUX variable by adding the string intel_iommu=off at the end. For example: GRUB_CMDLINE_LINUX=“cl_platform=cel_e1031 console=ttyS1,115200n8 intel_iommu=off"3. Run the update-grub command4. Reboot the switch. |
3.7.11-4.2.1 | 4.3.0-4.4.5 |
| 2554719 |
A slow memory leak is observed (1% per 14 hours) in kmalloc-256. To work around this issue, reboot the switch. |
3.7.12-3.7.14.2 | 3.7.15-3.7.16 |
| 2554709 |
The IP address specified in the ip pim use-source command configured on the loopback interface should be inherited by unnumbered interfaces during their Primary IP address selection process. If ip pim use-source is configured on the loopback after an unnumbered interface has already selected their Primary IP address, the unnumbered interface does not update its Primary IP address to be the new use-source value until after there is a netlink update for that interface.To work around this issue, configure ip pim use-source on each unnumbered interface directly or ensure ip pim use-source is applied to the loopback before other unnumbered interfaces are enabled for PIM. |
3.7.13-3.7.16, 4.2.1-4.4.5 | |
| 2554588 |
If you try to reconfigure a DHCP server after you delete the switch configuration with the net del all command, the dhcpd service fails because a duplicate process is runningTo work around this issue, edit the /usr/lib/python2.7/dist-packages/nclu/plugins/dhcp.py file to change:DHCPD_PID="-pf {0}” to:DHCPD_PID="-pf {1}" |
3.7.13-4.2.1 | 4.3.0-4.4.5 |
| 2554369 |
Certain Dell S4048-ON switches show an incorrect vendor name and hang when you issue the reboot command. |
3.7.12-4.2.1 | 4.3.0-4.4.5 |
| 2554329 |
On the Dell N3248PXE switch, fixed RJ45 interfaces with PoE neighbors can end up in Paused mode after a switchd restart, which blocks traffic on that interface. |
3.7.12-3.7.16 | |
| 2554232 |
VXLAN encapsulated traffic is not routed to the next hop because the destination VTEP IP address is mis-programmed on the switch, which decapsulates the traffic unexpectedly. To work around this issue, restart switchd. |
3.7.12-3.7.13 | 3.7.14-3.7.16 |
| 2553887 |
When using TACACS+ configured with a DEFAULT user providing privilege level lower than 16, TACACS+ configured users with privilege level 16 access might not be able to run privilege level 16 NCLU commands, such as net add and net del and see an error similar to the following:
To work around this issue, remove the DEFAULT user from the TACACS+ server. |
3.7.7-3.7.16, 4.0.0-4.4.5 | |
| 2553748 |
On switches with the Spectrum ASIC, the IPv6 default route is present in the kernel but missing in hardware. | 3.7.11-4.2.1 | 4.3.0-4.4.5 |
| 2553732 |
A ping via a dual-connected bond fails, and the audio stream is not routed or encapsulated through the layer 3 VNI. | 3.7.12-4.2.1 | 4.3.0-4.4.5 |
| 2553677 |
When you configure an SNMPv3 user with the net-snmp-config configuration command from the libsnmp-dev package, you get an error message similar to the one below:
To work around this issue, use the NCLU command to configure SNMPv3 user parameters; for example:
Alternatively, directly edit the /etc/snmp/snmpd.conf file as described in the documentation. |
3.7.13-3.7.16, 4.0.0-4.4.5 | |
| 2553588 |
Multicast traffic on a VPN is sent to remote VTEPs that are not part of the VPN and the remote VTEPs receive multicast traffic encapsulated in a VXLAN ID that doesn’t exist. To work around this issue, disable IGMP snooping on the switch. |
3.7.12-4.2.1 | 4.3.0-4.4.5 |
| 2553530 |
In an MLAG configuration with a layer 3 VNI, when you bounce the peer link, all layer 2 VNIs listed under the layer 3 VNI are duplicated. To work around this issue, restart FRR with the sudo systemctl restart frr.service command. |
3.7.10-4.2.1 | 4.3.0-4.4.5 |
| 2553450 |
On the the Dell N3248-PXE switch, when you insert two PSUs at different times, the newly inserted PSU is detected as OK but the fan and temp sensors are ABSENT. To work around this issue, remove power to both PSUs at the same time, then reinsert power simultaneously. |
3.7.12-4.2.1 | 4.3.0-4.4.5 |
| 2553229 |
On the Dell N3248PXE switch, RJ45 fixed copper ports that auto-negotiate with a 100M or 10M neighbor incorrectly negotiate a half-duplex link that generates errors. Half duplex modes are not supported on this platform. | 3.7.12-4.2.1 | 4.3.0-4.4.5 |
| 2553219 |
You cannot configure SNMPv3 trap-destinations in non-default VRFs with an authentication username that contains fewer than eight characters. | 3.7.12-4.2.1 | 4.3.0-4.4.5 |
| 2553116 |
When you manually set the link speed or duplex mode with ethtool to an unsupported value, then run a TDR check against the interface, you encounter a switchd service heartbeat failure.To work around this issue, reboot the switch to clear the condition. Avoid setting the interface speed or duplex mode directly with ethtool. |
3.7.12-3.7.16, 4.0.0-4.4.5 | |
| 2553050 |
SNMP status might incorrectly reflect that a BGP neighbor is down due to an issue between bgpd and SNMP AgentX when the IP-FORWARD-MIB is also polled.To work around this issue, avoid polling IP-FORWARD-MIB objects. |
3.7.12-3.7.16 | |
| 2553015 |
If a neighbour contains a special character in PortID for LLDP, the net show interface command does not display the LLDP information or the command might fail. |
3.7.10-3.7.16, 4.2.0-4.4.5 | |
| 2553001 |
When the following conditions exist, clagd might fail to establish a TCP control session across the subinterface (such as, peerlink.4094): * clagd uses an IPv6 link-local address (LLA) to establish the TCP connection (the clagd-peer-ip linklocal command configures an IPv6 LLA connection)* Subsequent VLAN changes are made to VLAN sub-interfaces or adding or removing SVIs This issue occurs because the hardware stores one entry per VRF to represent the IPv6 LLA. The hardware entry for the LLA is removed when another interface is changed because the software interfaces are represented by a single entity in hardware. As a result, packets destined to the local IPv6 LLA address are received on the port but do not get forwarded to CPU for further processing. To workaround this issue, use IPv4 addresses under peerlink.4094 and configure clagd to peer on IPv4 addresses. |
3.7.12-4.1.1 | 4.2.0-4.4.5 |
| 2552939 |
RX_DRP on a bond interface increases without any data traffic while the slave port does not increase. | 3.7.12-4.2.1 | 4.3.0-4.4.5 |
| 2552925 |
On the EdgeCore AS-6712-32X, AS5812-54X and AS5812-54T switch models, the temp sensors (DIMM temp sensor) show ABSENT. The amber diagnostic light on the front of the switch might also be turned on due to this issue. These messages and the light are cosmetic issues only and do not otherwise impact the function of the switch. |
3.7.12-3.7.13 | 3.7.14-3.7.16 |
| 2552881 |
IPv6 TCP or UDP connections (sourcing from an ephemeral port in the range 34048 to 35071) are not forwarded if the switch has more than one layer 2 VNI defined. The traffic might be locally switched on the bridge and dropped. To work around this issue, disable ARP/ND suppression to remove the internal ACL rule that affects the ports. |
3.7.13-4.2.1 | 4.3.0-4.4.5 |
| 2552869 |
On the Dell N3048EP switch, the module information from SFP ports is not displayed in the l1-show command.To work around this issue, use the ethtool -m command. |
3.7.13-4.2.1 | 4.3.0-4.4.5 |
| 2552859 |
Mellanox switches with the Spectrum ASIC fail to read PSU Fan/Temp sensors and report them as Absent. The following messages are observed in syslog:
|
3.7.13 | 3.7.14-3.7.16 |
| 2552742 |
On the Mellanox SN2410 switch, you see switchd core and GBIN_MALLOC errors.To work around this issue, restart switchd. |
3.7.12-4.2.1 | 4.3.0-4.4.5 |
| 2552739 |
Counters for IPROUTER rules do not increase when traffic is forwarded to the CPU because there is no IP neighbor. | 3.7.2-3.7.16 | |
| 2552647 |
When you add a member to a bond that has a subinterface configured (such as peerlink.4094), the new member is assigned only the VLAN of the subinterface for forwarding. To work around this issue, bounce the bond or shutdown the new interface and use the remaining members over the bond. |
3.7.10-4.2.0 | 4.2.1-4.4.5 |
| 2552528 |
Ingress SPAN/ERSPAN does not mirror packets when the next hop is EVPN encapsulated. | 3.7.7-4.2.1 | 4.3.0-4.4.5 |
| 2552506 |
Changing the order of the bridge ports might cause the bridge MAC address to change, which flaps the bridge and its ports. To work around this issue, manually set the MAC address of the bridge interface by adding hwaddress to the bridge stanza in the /etc/network/interfaces file. |
3.7.11-4.2.0 | 4.2.1-4.4.5 |
| 2552301 |
On a Mellanox switch with the Spectrum ASIC, you see LPC I2C driver errors similar to the following during boot:
|
3.7.13 | 3.7.14-3.7.16 |
| 2552294 |
NCLU restarts FRR when removing a BGP VRF IPv4 aggregate-address command. |
3.7.12-3.7.16, 4.0.0-4.4.5 | |
| 2552214 |
The Mellanox SN2700 and SN2410 switch intermittently reports PSU fan state changes with Unable to read from device/fan1_input/pwm1 syslog messages. |
3.7.11-3.7.14.2, 4.1.1-4.3.0 | 3.7.15-3.7.16, 4.3.1-4.4.5, 4.4.0-4.4.5 |
| 2552205 |
If the MAC address of an SVI changes, clagd does not update its permanent neighbor entry for the local interface, and it does not report the change to its MLAG peer. This leaves the MLAG peer in a state where its permanent neighbor for the MLAG peer’s SVI IP address continues to use the old MAC address, which causes routed traffic over this SVI to be dropped.To work around this issue, ifdown/ifup the SVI when a MAC address changes. |
3.7.12-4.2.0 | 4.2.1-4.4.5 |
| 2551911 |
ifupdown2 does not account for link status or link down configuration when running dhclient. For example, ifupdown2 ignores link-down yes during ifup/ifreload and runs the DHCP module if inet dhcp is configured on the interface. ifupdown2 also runs the DHCP module even when the physical link configured for DHCP is down. |
3.7.12-4.2.0 | 4.2.1-4.4.5 |
| 2551748 |
In OVSDB high availability mode, deleting > 200 VLAN bindings might cause ovs-vtepd to crash. Limit the deletion to 200 or fewer VLAN bindings. |
3.7.12-4.2.1 | 4.3.0-4.4.5 |
| 2551731 |
When the OVSDB VTEP scale increases, the CPU utilization increases and eventually the switch (ptmd) fails to respond to the BFD, causing the BFD session to go down. As a result OVSDB cannot read the BFD socket status and outputs a warning in the ovs-vtepd debugs: PTM socket error: Bad file descriptor. |
3.7.12-4.2.0 | 4.2.1-4.4.5 |
| 2551728 |
In OVSDB high availability mode, if you create, then delete a binding, the FDB entry is not replaced and you see an error. | 3.7.12-4.2.0 | 4.2.1-4.4.5 |
| 2551714 |
There is a change to the default OVSDB bootstrapping process, where the script created now defaults to VLAN-aware bridge mode. If you want to use traditional bride mode, you need to force it by editing the ovs-vtep-ctl script generated by the bootstrap process. |
3.7.12-4.2.0 | 4.2.1-4.4.5 |
| 2551693 |
A host migrated to an 802.1X MAB port within the same broadcast domain fails to have the correct FDB entry installed if a dynamic FDB entry for that MAC address exists from previous connectivity in the broadcast domain. To work around this issue, manually delete the dynamic FDB entry that is associated with the uplink trunk port. |
3.7.12-4.2.0 | 4.2.1-4.4.5 |
| 2551675 |
When you restart clagd, the edge port setting on the peer link changes. |
3.7.2-4.2.0 | 4.2.1-4.4.5 |
| 2551651 |
The net show dot1x interface summary command output shows a MAC address with all zeros associated with a port. |
3.7.12-4.2.0 | 4.2.1-4.4.5 |
| 2551578 |
When you configure a bridge in the /etc/network/interfaces file, then try to reconfigure the bridge to be a VRF interface with the same name, ifreload/ifup commands fail with an invalid table id or unable to get vrf table id error. |
3.7.12-3.7.16, 4.0.0-4.4.5 | |
| 2551565 |
If you toggle VRRP priority values between VRRP routers, then restart switchd, a few IPv6 VRRP instances might not converge. As a result, both the VRRP routers act as master routers for the impacted IPv6 VRRP instances. IPv4 VRRP instances are not affectedTo work around this issue, remove, then add back the VRRP configuration with NCLU or vtysh commands. |
3.7.13-3.7.16, 4.2.0-4.4.5 | |
| 2551305 |
The net show configuration command provides the wrong net add command for ACL under the VLAN interface. |
3.7.12-3.7.16, 4.1.0-4.4.5 | |
| 2551288 |
When you remove BFD configuration by editing the /etc/frr/frr.conf file and restarting FRR, you see a traceback.To work around this issue, either use NCLU or vtysh commands to remove the BFD configuration, or restart FRR with the new /etc/frr/frr.conf file. |
3.7.7-3.7.16 | 4.0.0-4.4.5 |
| 2550974 |
On the Dell S3000 switch, after installing the Cumulus Linux 4.1.1 disk image without a license, the switch sends a link beat if a remote host port is configured. | 3.7.11-3.7.16, 4.1.1-4.4.5 | |
| 2550942 |
NCLU tab completion for net show displays the text add help text instead of system Information for the system option. |
3.7.11-4.2.0 | 4.2.1-4.4.5 |
| 2550873 |
In an MLAG configuration with static VXLAN, static tunnels become unreachable. | 3.7.13-4.2.0 | 4.2.1-4.4.5 |
| 2550796 |
On a Broadcom switch with the Trident2+ ASIC, ACL rules for VLANs are not applied after a reboot and the counters remain at zero. To work around this issue, either do not set acl.non_atomic_update_mode = TRUE in the /etc/cumulus/switchd.conf file or run the cl-acltool -i command after the reboot to install the ACLs. |
3.7.12-4.2.1 | 4.3.0-4.4.5 |
| 2550793 |
The NCLU net show bridge spanning-tree command displays the aging timer incorrectly. |
3.7.12-3.7.16, 4.0.0-4.4.5 | |
| 2550600 |
The received PVST BPDU for a VLAN is flooded even though the ingress port doesn’t have the VLAN tagged. | 3.7.8-3.7.14.2, 4.0.0-4.3.0 | 3.7.15-3.7.16, 4.3.1-4.4.5, 4.4.0-4.4.5 |
| 2550478 |
VXLAN interface as in-interface or out-interface in an ACL is not supported in Spectrum-based switches. | 3.7.7-4.2.0 | 4.2.1-4.4.5, 4.3.0-4.4.5 |
| 2550444 |
Tab completion for the net show rollback description command returns information about a snapshot instead of context help.To work around this issue, run the net show commit history command to find descriptions instead of the net show rollback description command. |
3.7.12-3.7.16, 4.0.0-4.4.5 | |
| 2550443 |
The net show rollback description command returns an error even if the string matches a commit description.To work around this issue, look for your string in the output of the net show commit history command (or grep for it there) instead. |
3.7.12-3.7.16, 4.0.0-4.4.5 | |
| 2550375 |
CPU utilization may increase when clag-managed bond interfaces are operationally/LACP down but the physical carrier remains up on the bond member switchports. This condition occurs when clag bond redirection is enabled and bond members remain up while the parent bond does not negotiate LACP. This issue is resolved in Cumulus Linux 3.7.14. |
3.7.9-4.2.1 | 4.3.0-4.4.5 |
| 2550350 |
Unicast traffic from downlink hosts is flooded to multiple remote VTEPs, which might also cause high HwIfOutQDrops/TX_DRP on the uplink ports. To work around this issue, restart switchd. |
3.7.10-4.1.1 | 4.2.0-4.4.5 |
| 2550276 |
In LLDP, the snmp subagent loses all subsequent lldpRemSysName (1.0.8802.1.1.2.1.4.1.1.9) entries after an entry with a missing SysName is added.All the information from lldpctl is correct. Only the entries after the entry that is missing a SysName in lldpRemSysName disappear from the snmp subagent. |
3.7.12-4.2.1 | 4.3.0-4.4.5 |
| 2550243 |
When you use nginx and restserver in management VRF to provide a REST API for the switch, nginx starts but restserver fails to start.To work around this issue, comment out the Requires= line in the /lib/systemd/system/restserver.service. For example:
|
3.7.12-3.7.16, 4.0.0-4.4.5 | |
| 2550056 |
The ACCTON-DIAG option under the Cumulus Linux GRUB menu does not work. When you select this option, you see the following error:
|
3.7.12-3.7.16, 4.1.1-4.4.5 | |
| 2549925 |
When you run an Ansible script to replace the /etc/network/interfaces file, then run the ifreload -a command, you see errors similar to the following:
To work around this issue, run the ifreload -a command a second time. |
3.7.12-3.7.16, 4.0.0-4.4.5 | |
| 2549872 |
If you have an SVI with multiple VRR IP addresses and try to delete one of the VRR configurations, net commit or ifreload -a returns an error. |
3.7.12-3.7.16, 4.1.1-4.4.5 | |
| 2549838 |
In vtysh, if you configure, then remove a layer 3 VNI for a VRF, the VNI is removed from zebra even if the VNI interface still exists in the kernel. If you configure a layer 2 VNI as a layer 3 VNI by mistake, removing the layer 3 VNI binding removes it from zebra but EVPN-learned MACs and neighbors are not installed into the kernel. To work around this issue, delete, then re-add the missing VNI. For example:
If you flap the link with the ip link set vni10100 down; ip link set vni10100 up commands, zebra does not re-add the VNI. |
3.7.12-4.2.1 | 4.3.0-4.4.5 |
| 2549794 |
The asic-monitor.service fails when you configure /etc/cumulus/datapath/monitor.conf with monitor.histogram_pg.collect.port_group_list = [all_packet_pg] and there is traffic passing through the buffer. When the service fails, you see the following traceback in journalctl:
|
3.7.11-4.2.0 | 4.2.1-4.4.5 |
| 2549782 |
The JSON format output of the net show bgp l2vpn evpn summary command shows the incorrect neighbour state. |
3.7.12-3.7.16, 4.0.0-4.4.5 | |
| 2549731 |
When you create SPAN or ERSPAN rules in ebtables, the action fails to install if it is not in lowercase. Make sure that the SPAN or ERSPAN action is all lowercase; for example:
|
3.7.12-3.7.16, 4.1.1-4.4.5 | |
| 2549472 |
On switches with the Trident3 ASIC, PFC is not working as expected. If you set the PFC for only one CoS, pause frames are sent for all CoS traffic. | 3.7.11-4.1.1 | 4.2.0-4.4.5 |
| 2549371 |
When Optimized Multicast Flooding (OMF) is enabled with the bridge.optimized_mcast_flood = TRUE setting in the /etc/cumulus/switchd.conf file, the switch continues to flood IPv6 multicast traffic to all slave ports when there is no MLD join receive. |
3.7.11-4.3.3 | 4.4.0-4.4.5 |
| 2549226 |
You might see the following gport error messages in switchd.log:
These messages are harmless and can be ignored. |
3.7.12-4.2.1 | 4.3.0-4.4.5 |
| 2548962 |
With FRR or OSPF, you might see an inconsistent link-state advertisement. For example, when you configure the OSPF default originate route as metric-type 1 with a specific metric, Cumulus Linux shows the default originate route as an external metric-type 2 route with the default metric in the database. This issue typically occurs when both IPv4 and IPv6 default routes exist in the routing table. | 3.7.12-4.1.1 | 4.2.0-4.4.5 |
| 2548930 |
On Mellanox Spectrum switches that contain an OSPF IP unnumbered neighborship with a high scale of prefixes being learned, a link flap might cause the neighbor entry to not be programmed in hardware. | 3.7.11-4.2.1 | 4.3.0-4.4.5 |
| 2548746 |
On the Broadcom switch with the Trident3 ASIC, packet priority remark values assigned from each internal CoS value continue to work with default values; if you change the internal CoS value, the change does not take effect. | 3.7.11-4.1.1 | 4.2.0-4.4.5 |
| 2548657 |
When you upgrade Cumulus Linux on the EdgeCore AS7726-32X or AS7326-56X switch, you might see firmware errors similar to the following:
You can safely ignore these error messages. |
3.7.12-3.7.16, 4.0.0-4.4.5 | |
| 2548490 |
A change in a route map prefix list that should remove a route might not be reflected in the ospf6 database or in peers, and the route might not be deleted. To work around this issue, reenter the redistribute <connected|static> route-map statement in the configuration. |
3.7.11-4.1.1 | 4.2.0-4.4.5 |
| 2548485 |
If you configure the aggregate-address summary-only option before injecting a component of the same aggregate into the BGP table with the network or redistribute command, when you remove the aggregate-address configuration, the component stays suppressed; it is not advertised to peers. For example:Existing configuration:router bgp 1If you add network 50.0.0.1/32, you see the following (expected) BGP table entries:Status codes: s suppressed, d damped, h history, * valid, > best, = multipath,Removing aggregate-address 50.0.0.0/8 summary-only at this point results in the following (unexpected) BGP table entry:Status codes: s suppressed, d damped, h history, * valid, > best, = multipath,To work around this issue, remove, then re-add the component prefix routes. |
3.7.12-4.2.1 | 4.3.0-4.4.5 |
| 2548475 |
After you add a new VNI and a layer 3 SVI to a set of leafs, certain leafs might not be able to communicate on the layer 3 VNI. To work around this issue, reboot the leaf switch or restart switchd. |
3.7.6-3.7.16 | 4.0.0-4.4.5 |
| 2548243 |
On switches with the Trident2+ ASIC, adding SPAN rules disables PBR rules. | 3.7.3-3.7.16, 4.0.0-4.4.5 | |
| 2548155 |
The net show bgp neighbor swpX json command shows negative output for the bgpTimerUpMsec timer. |
3.7.10-3.7.16 | 4.0.0-4.4.5 |
| 2548117 |
In OVSDB traditional bridge mode, adding or removing a VLAN binding causes a traffic forwarding outage for around 20 seconds or more on adjacent VLAN bindings. Cumulus Linux does not support traditional bridge mode with VMware NSX. | 3.7.12-3.7.16, 4.0.0-4.4.5 | |
| 2548044 |
When a remote VTEP withdraws a type-3 EVPN route, Cumulus Linux purges all MAC address and neighbor entries installed in the corresponding layer 2 VNI through that remote VTEP from the local EVPN and kernel forwarding tables. This purge occurs even if the remote VTEP does not withdraw type-2 routes carrying the MAC address or neighbor entries. The entries stay missing from the local EVPN and kernel forwarding tables until BGP updates the MAC address and neighbor. | 3.7.12-3.7.15, 4.0.0-4.4.5 | 3.7.16 |
| 2548024 |
On the Dell Z9100 switch, 100G-SR4 modules might not link up reliably in certain ports. swp1, 2, 3, 9, 10, 23, 24, 30, 31, and 32 might be affected To work around this issue, move 100G SR4 modules to one of the ports not affected by this issue. |
3.7.11-4.1.1 | 4.2.0-4.4.5 |
| 2547942 |
On the Lenovo NE0152T switch, one power supply (PSU2) always show as ABSENT in smonctl. | 3.7.11-4.0.1 | 4.1.0-4.4.5 |
| 2547839 |
When you try to configure link-down on a parent interface of a subinterface configured in a VRF, you encounter an error. |
3.7.11-4.1.1 | 4.2.0-4.4.5 |
| 2547799 |
An error similar to the following shows in syslog for Mellanox switches:
To work around this issue, reboot the switch. |
3.7.11-4.0.1 | 4.1.0-4.4.5 |
| 2547784 |
PTM mis-detects incorrect hostnames of LLDP neighbors and does not fail them as expected. Instead they end up in an N/A cabling status. | 3.7.11-4.1.1 | 4.2.0-4.4.5 |
| 2547782 |
If a LLDP neighbor advertises a PortDescr that contains commas, ptmctl -d splits the string on the commas and misplaces its components in other columns. |
3.7.11-3.7.16, 4.0.0-4.4.5 | |
| 2547706 |
When you configure ganged ports in the ports.conf file, the change does not take effect after you restart switchd. To work around this issue, reboot the switch. |
3.7.11-3.7.16, 4.0.0-4.4.5 | |
| 2547659 |
On the EdgeCore AS7326-56X switch, the default fan speed, which is defined in the thermal specification, results in excessive fan noise. | 3.7.11-4.0.1 | 4.1.0-4.4.5 |
| 2547573 |
On Tomahawk switches, when the vxlan_tnl_arp_punt_disable option is set to FALSE, ARP packets are not forwarded to the CPU. |
3.7.9-3.7.16 | |
| 2547443 |
On the Dell N3248PXE-ON switch, 25G SFP ports do not work in 10G mode. | 3.7.11-4.0.1 | 4.1.0-4.4.5 |
| 2547381 |
The hsflowd service sends an undefined header protocol 0 in the sampled flow sample to the collector, which is not recognized by the sFlow tool. You see errors similar to the following:
|
3.7.11-3.7.16 | 4.0.0-4.4.5 |
| 2547349 |
When you change an interface IP address, then change it back, static routes are misprogrammed One of the following actions recovers the routes:- Bounce both layer 3 interfaces- Remove or add static routes in FRR- Restart FRR |
3.7.11-3.7.16 | 4.0.0-4.4.5 |
| 2547341 |
When host-resources and ucd-snmp-mib are polled, you see permission denied messages similar to the following:
|
3.7.13-4.1.1 | 4.2.0-4.4.5 |
| 2547246 |
The MLAG switch pair has VLANs defined that are not used on MLAG bonds. These VLANs still synchronize MAC addresses across to the peer switch. This results in log messages that indicate a MAC address is installed and the VLAN is not defined; for example:
|
3.7.10-4.1.1 | 4.2.0-4.4.5 |
| 2547123 |
On the Broadcom switch with the Trident3 ASC, packet priority remark values assigned from each internal CoS value continue to work with default values; if you change the internal CoS value, the change does not take effect. | 3.7.11-4.1.1 | 4.2.0-4.4.5 |
| 2547120 |
After you hot swap a PSU, the decode-syseeprom -t psuX command shows the old PSU information (such as the serial number), until you run the decode-syseeprom –init command. |
3.7.11-3.7.16, 4.0.0-4.4.5 | |
| 2547100 |
On switches with the Trident3 ASIC, PFC is not working as expected. If you set the PFC for only one CoS, pause frames are sent for all CoS traffic. | 3.7.11-4.1.1 | 4.2.0-4.4.5 |
| 2547068 |
Hardware platforms using the Intel D-1500 CPU series might reboot unexpectedly To work around this issue, contact your hardware vendor to inquire if a new version of BIOS with a microcode fix is available or manually disable CPU C-states in the kernel as outlined below To permanently disable C-states using a kernel boot parameter:1. Edit /etc/default/grub to add the argument processor.max_cstate=0 to the variable GRUB_CMDLINE_LINUX. For example, if /etc/default/grub file contains the line GRUB_CMDLINE_LINUX=“cl_platform=accton_as7726_32x console=tty0 console=ttyS0,115200n8 intel_iommu=off pcie_aspm=off”, change it to GRUB_CMDLINE_LINUX=“cl_platform=accton_as7726_32x console=tty0 console=ttyS0,115200n8 intel_iommu=off pcie_aspm=off processor.max_cstate=0”2. Run sudo update-grub3. Reboot the system with sudo rebootTo disable cstates in realtime on the current system, which does not persist through a reboot:1. Confirm that the libpci3 package is installed. Run dpkg-query -l libpci3 and confirm the following line is displayed:ii libpci3:amd64 1:3.2.1-3 amd64 Linux PCI Utilities (shared library)The first field above should read ii. If not, install the libpci3 package by running sudo apt upgrade;sudo apt install libpci32. Disable C-states by running the command ./cpupower idle-set -d 2C-states are disabled by default in Cumulus Linux 4.3.0 and later. |
3.7.9-4.2.1 | 4.3.0-4.4.5 |
| 2546991 |
The FRR service does not provide a way for automation to know if the configuration applied properly. To work around this issue, execute the vtysh -f command in the automation file before starting the FRR service to validate the functional configuration and return an error code. |
3.7.11-3.7.16, 4.0.0-4.4.5 | |
| 2546895 |
If you have configured a higher number of ports and VLANs (ports x VLANs) or the switch is a lower-powered (CPU) platform, the switchd service might fail to send a systemd keepalive within the watchdog timeout value (2 minutes by default) and you see an error similar to the following:bq. systemd[1]: switchd.service watchdog timeout (limit 2min)!To workaround this issue, either reduce the number of configured interfaces and, or VLANs, or increase the systemd timeout for switchd.serviceTo increase the systemd timeout:1.Edit the /etc/systemd/system/switchd.service.d/override.conf file and increase the WatchdogSec parameter2.Restart the switchd service with the sudo systemctl restart switchd.service commandsystemd attempts to restart the switchd service automatically (after the watchdog timeout). If the restart fails multiple times in a short time period, run the sudo systemctl reset-failed command followed by the sudo systemctl restart switchd command. |
3.7.11-3.7.16, 4.0.0-4.4.5 | |
| 2546577 |
A traditional bridge with QinQ and a VNI does not work for tagged traffic. | 3.7.10-4.0.1 | 4.1.0-4.4.5 |
| 2546450 |
On the EdgeCore AS7326-56X switch, you might see the RPM of certain fans run over the maximum threshold. | 3.7.11-3.7.16 | |
| 2546385 |
SNMP ifLastChange reports link transitions when there are none. | 3.7.6-3.7.16 | |
| 2546225 |
When you execute the following command on the Delta AG6248C switch, the switch reboots and then comes right back into Cumulus Linux without installing the new image. The install image is still in /var/lib/cumulus/installer, which causes issues with cl-support.
To work around this issue, use the onie-select command to access ONIE, and then use the nos-install command in ONIE to install a new binary image. |
3.7.11-3.7.16, 4.0.0-4.4.5 | |
| 2546203 |
When using QinQ with a traditional bridge, if you enable the LLDP dot1 TLV option, you see the following suboptimal behavior: * Both the inner and outer VLAN information is sent as part of VLAN TLVs in the LLDP packet. * If the outer VLAN ID is the same as the inner VLAN ID, only one VLAN TLV is sent with that VLAN ID in the LLDP packet. |
3.7.11-3.7.16 | |
| 2546131 |
On the Delta AG-6248C PoE switch, when you run the apt upgrade command, the upgrade does not work. Cumulus Linux uses uboot directly instead of grub to boot the kernel. Uboot needs a special header to boot the kernel, which is not present. Without this header, when you use the apt upgrade command to upgrade Linux packages, uboot is unable to boot up the kernel. To work around this issue, upgrade Cumulus Linux by installing the Cumulus Linux image. Run the onie-select command to go into ONIE, and then use the nos-install command in ONIE to install a new image.This workaround only works when an out-of-band network is present. |
3.7.11-3.7.16, 4.0.0-4.4.5 | |
| 2546010 |
When hal.bcm.per_vlan_router_mac_lookup is set to TRUE in the /etc/cumulus/switchd.conf file, inter-VLAN traffic is forwarded to the CPU when associated VNI interfaces exist. |
3.7.10-3.7.16 | |
| 2545997 |
The NCLU command net show interface produces an error if bonds with no members exist.To work around this issue, remove the empty Bond interfaces from the /etc/network/interfaces file and run sudo ifreload -a. |
3.7.10-3.7.16 | |
| 2545934 |
Mellanox switches might experience higher CPU usage from the sx_sdk service or when BFD is in use.To work around this issue, disable BFD to alleviate some of the CPU load. |
3.7.13-4.1.1 | 4.2.0-4.4.5 |
| 2545699 |
On the Celestica Pebble switch, if you use IPv6 routes with mask /65 to /127, the switchd log fills with errors. |
3.7.10-4.0.1 | 4.1.0-4.4.5 |
| 2545566 |
The Dell Z9100-ON switch incorrectly reports many sensors as ABSENT. | 3.7.12-4.0.1 | 4.1.0-4.4.5 |
| 2545446 |
If you use NCLU commands to add a non-MLAG bond, then add an MLAG configuration, the net commit command fails. However, a subsequent net commit command succeeds. |
3.7.10-3.7.16 | |
| 2545404 |
On the Trident3 switch, unicast ARP packets received on a VNI and forwarded to the CPU are not policed. | 3.7.10-4.0.1 | 4.1.0-4.4.5 |
| 2545125 |
If you configure more than one VRR interface on an SVI interface, deleting one of the VRR addresses does not remove the interface/address. | 3.7.10-3.7.16, 4.0.0-4.4.5 | |
| 2544978 |
If you delete an undefined bond, then add a bond slave, the net commit command fails. |
3.7.9-3.7.16, 4.0.0-4.4.5 | |
| 2544968 |
FRR configuration commands for an SVI interface might have the \n misplaced in the output. For example:
should be:
To work around this issue, configure the interface manually in the /etc/frr/frr.conf file. |
3.7.9-3.7.16, 4.0.0-4.4.5 | |
| 2544953 |
When you update the hostname of a switch with the NCLU net add hostname command, then run net commit, the lldpd service does not restart and other devices still see the old hostname.To work around this issue, run the sudo systemctl restart lldpd.service command. |
3.7.10-3.7.16, 4.0.0-4.4.5 | |
| 2544904 |
After you delete an IPv6 numbered BGP peer group neighbor, Cumulus Linux might continue to send route advertisements. To work around this issue, restart FRR after removing the IPv6 numbered configuration. |
3.7.9-4.1.1 | 4.2.0-4.4.5 |
| 2544829 |
Frames received with a VLAN tag of 0 on an interface configured as a bridge port and forwarded to the CPU for processing might appear tagged with the native VLAN when viewed with tcpdump. |
3.7.8-3.7.16 | |
| 2544556 |
If you reconfigure an NTP server with NCLU using different trailing options after the IP address (such as iburst), an invalid configuration is added to the /etc/ntp.conf file. For example:
If you need to alter existing server configurations, first remove the server, commit, then re-add the server with any trailing options. |
3.7.9-4.1.1 | 4.2.0-4.4.5 |
| 2544463 |
Auto-negotiation does not work with the QSFP28 cables and a remote system operating at 10G. Attempting to enable auto-negotiation with ethtool -s swp<#> autoneg on returns Operation not supported.To work around this issue, do not use auto-negotiation and set the local port speed to 10G. |
3.7.9-3.7.16, 4.0.0-4.4.5 | |
| 2544456 |
The NCLU net show lldp command displays the speed of a ganged port group as the speed of one of the individual links, rather than the sum of their speeds. |
3.7.9-3.7.16, 4.0.0-4.4.5 | |
| 2544311 |
Applying a policy-based routing (PBR) rule for all traffic from a host might disrupt ARP refresh for that connected host. | 3.7.5-3.7.16, 4.0.0-4.4.5 | |
| 2544155 |
NCLU requires you to specify an interface with multiple address-virtual statements in ascending MAC address order. |
3.7.5-3.7.16, 4.0.0-4.4.5 | |
| 2544113 |
Mac learning is not disabled by default on a double tagged peer link interface resulting in the MAC address changing between the MLAG bond and the peer link. To work around this issue, disable MAC learning on QinQ VLANs by adding bridge-learning off to the VLAN stanza in the etc/network/interfaces file. |
3.7.9-3.7.16, 4.0.0-4.4.5 | |
| 2543900 |
On the Mellanox switch, static VXLAN tunnels incorrectly allow traffic from any remote tunnel IP address. | 3.7.8-3.7.16, 4.0.0-4.4.5 | |
| 2543841 |
The net show evpn vni detail json command includes an extra empty dictionary at the end of the output. |
3.7.8-3.7.16, 4.0.0-4.4.5 | |
| 2543840 |
On the Mellanox SN2700 switch, you cannot enable resilient hashing (RASH) and set the bucket size to 64 in the traffic.conf file. |
3.7.6-3.7.16 | |
| 2543800 |
When local-tunnelip is an SVI, the static VXLAN tunnel does not work; the next hop router receives the packet but drops it as it does not know where to forward the packet. The static VXLAN tunnel does works if local-tunnelip is a loopback or a physical layer 3 interface. |
3.7.8-3.7.16 | 4.0.0-4.4.5 |
| 2543647 |
ERSPAN in ebtables does not work for VNIs. For example, the following rule does not work:
|
3.7.6-4.2.1 | 4.3.0-4.4.5 |
| 2543646 |
In an ebtables rule, ERSPAN (upper case) does not work. You need to specify erspan (lower case). | 3.7.6-3.7.16, 4.0.0-4.4.5 | |
| 2543627 |
Tomahawk 40G DACs cannot disable auto-negotiation. | 3.7.7-3.7.16 | 4.0.0-4.4.5 |
| 2543270 |
The default route injected through OSPF when you configure default-information originate always is unreliable and might age out unexpectedly.To work around this issue, rely on a different source of default route other than injection with default-information originate. |
3.7.8-4.1.1 | 4.2.0-4.4.5 |
| 2543211 |
In some cases, the switchd service might warn of excessive MAC moves from one switch port to itself (for example, from swp18 to swp18). |
3.7.0-3.7.16, 4.0.0-4.4.5 | |
| 2543164 |
The MTU of an SVI cannot be higher than the MTU on the bridge. Changing the MTU on the SVI with NCLU does not update the bridge MTU. The net commit command succeeds even though the MTU is not changed as expected.To work around this issue, change the MTU on all SVIs and the bridge manually in the /etc/network/interfaces file, then apply the change with the ifreload -a command. |
3.7.7-3.7.16, 4.0.0-4.4.5 | |
| 2543096 |
When an SVI with a virtual MAC is configured with a layer 2 VNI in an EVPN environment, if you replace the /etc/network/interfaces file with a different file that does not have the SVI and layer 2 VNI configuration, the original virtual MAC is not populated through the EVPN route until FRR is restarted. |
3.7.6-3.7.16, 4.0.0-4.4.5 | |
| 2543058 |
The IP neighbor entry for a link-local next hop is not installed by FRR, which results in a forwarding failure for routes via that next hop. This is a rare problem that occurs with IPv4 route exchange over IPv6 GUA peering with no IPv4 addresses on the interfaces. To work around this issue, flap the peering to the peer router (which might be a route reflector) to recover. To avoid this issue, configure IPv6 router advertisements on the connecting interfaces. |
3.7.7-3.7.16 | 4.0.0-4.4.5 |
| 2543052 |
Received EVPN type-5 and type-2 MACIP routes are not installed in the kernel (and hardware) routing tables for the associated VRF, which causes traffic to be blackholed. The failure to install the default route causes complete reachability failure for the particular tenant on the affected racks. The routes that are not installed are seen as “inactive” in the routing subsystem (FRR) VRF routing table. This problem is rare and can occur only in EVPN configurations that have user-configured route targets (RTs) for tenant VRFs, and only following a restart of FRR. To work around this issue, either restart the FRR service on the affected switch with the sudo systemctl restart frr.service command or bounce the layer 3 SVI for the affected VRF; for example:
You can run the net show vrf vni command to print a mapping of VRF : L3-VNI : L3-SVI. |
3.7.5-3.7.16 | 4.0.0-4.4.5 |
| 2543044 |
Under certain conditions, EVPN next hops might not be removed when the contributing peer goes down or might not be populated when the BGP session to the contributing peer comes up. You can prevent EVPN next hops from not being removed when the contributing peer goes down by specifying static MAC addresses on all layer 3 VNIs. There is no workaround for preventing EVPN next hops from not being populated when the BGP session to the contributing peer comes up. |
3.7.2-3.7.16 | 4.0.0-4.4.5 |
| 2542979 |
On the Dell-N3048EP-ON switch, when you run the sudo -E apt upgrade command, the upgrade does not work. |
3.7.7-4.1.1 | 4.2.0-4.4.5 |
| 2542945 |
On the Broadcom Maverick switch with a QinQ configuration, the packets coming into the CPU might be tagged incorrectly; for example, 802.1ad + 802.1q tags are expected in the packets but the packets have 802.1q + 802.1q tags. To work around this issue, configure the bridge with bridge-vlan-protocol 802.1ad:
|
3.7.6-3.7.16, 4.0.0-4.4.5 | |
| 2542310 |
hsflow disregards the setting for agent.cidr in the /etc/hsflowd.conf file and selects an IPv6 agent address. The source IP address of the hsflowd packet is IPv4, but the agent address in the hsflow payload shows IPv6. |
3.7.6-3.7.16 | |
| 2542305 |
If an SVI exists in the configuration before you assign it an IP address, when you do assign the IP address with the NCLU command, the vlan-id and the raw-device bridge stanzas are not added automatically. |
3.7.6-3.7.16, 4.0.0-4.4.5 | |
| 2542301 |
When first creating a bond and enslaving an interface, NCLU hides some of the bridge command suggestions, although they are still accepted. |
3.7.3-3.7.16, 4.0.0-4.4.5 | |
| 2541212 |
The maximum-prefix configuration under the IPv4 address family has an optional restart value, which you can configure. This configuration is ignored and, instead of restarting the sessions every x minutes, the peer constantly changes between established and idle due to the prefix count being exceeded. |
3.7.5-3.7.16, 4.0.0-4.4.5 | |
| 2541165 |
On the Dell N3048EP-ON switch, UPOE is supported only on ports 1 thru 12. (UPOE uses all four pairs of standard Ethernet cabling whereas PoE delivers power over two twisted pairs.) When you plug a UPOE device in a port higher than port 12, poectl reports that four_pair_mode_enabled is true. However, this configuration is not supported on the port so poectl should report that four_pair_mode_enabled is false. |
3.7.6-3.7.16 | |
| 2541029 |
On switches with the Trident2 ASIC, 802.1Q-encapsulated control plane traffic received on an interface with 802.1AD configured subinterfaces might be dropped. This issue only affects QinQ configurations. |
3.7.5-3.7.16, 4.0.0-4.4.5 | |
| 2540950 |
On the QuantaMesh T4048-IX8 or EdgeCore AS7326-56X switch, when using a 1000BASE-T SFP module, the module LEDs do not light to reflect link status. |
3.7.3-4.1.1 | 4.2.0-4.4.5 |
| 2540885 |
The Dell N3048EP-ON switch does not support 1G Base-T modules in the SFP ports. | 3.7.7-3.7.16 | |
| 2540863 |
On the EdgeCore AS5812-54X switch, the PSU2 Fan1 fluctuates between OK and LOW. When the fan speed is reported as LOW, the RPM is shown as a negative number. |
3.7.3-3.7.16 | |
| 2540753 |
If the interface alias contains a single or double quotation mark, or an apostrophe, the net show configuration commands fail with the following error:
|
3.7.5-3.7.16, 4.0.0-4.4.5 | |
| 2540444 |
SNMP incorrectly requires engine ID specification. |
3.7.4-3.7.16, 4.0.0-4.4.5 | |
| 2540352 |
When you use NCLU to configure a route map, the parser allows for glob matching of interfaces for a match interface condition when there can only be a single interface matched. The proper syntax is to use multiple route map clauses, each matching a single interface, instead of a single clause matching multiple interfaces. For example, this command is incorrect:
These commands are correct:
|
3.7.2-3.7.16, 4.0.0-4.4.5 | |
| 2540340 |
NCLU allows for the configuration of addresses on VRF interfaces, but tab completion for the net add vrf command just displays
Tab completion for the net add vrf command works correctly. |
3.7.4-3.7.16, 4.0.0-4.4.5 | |
| 2540274 |
On the Maverick switch, CPU forwarded packets might be dropped when there is no route to a leaked host route. | 3.7.5-3.7.16, 4.0.0-4.4.5 | |
| 2540204 |
When links come up after FRR is started, VRF connected routes do not get redistributed. | 3.7.4-3.7.16, 4.0.0-4.4.5 | |
| 2540192 |
The net del bridge bridge mcsnoop yes command does not return the value to the default of disabled. To work around this issue, use the net add bridge bridge mcsnoop no command to delete the mcsnoop attribute and return to the default value. |
3.7.4-3.7.16, 4.0.0-4.4.5 | |
| 2540155 |
On the Broadcom switch, when moving configuration from bridged to routed (or toggling from routed to bridged to routed), some traffic is not seen by the kernel. This can cause BGP to not establish on a transit node. |
3.7.3-3.7.16, 4.0.0-4.4.5 | |
| 2540042 |
When you try to configure the VRRP priority and advertisement-interval with NCLU on a traditional mode bridge, the net commit command fails. To work around this issue, use the vtysh command (inside FRR) to change the VRRP priority or advertisement-interval on traditional bridges. For example:
|
3.7.4-3.7.16, 4.0.0-4.4.5 | |
| 2540041 |
On SVIs in a VLAN-aware bridge, you cannot change the VRRP priority with NCLU. To work around this issue, run the vtysh command inside FRR to change the default priority. For example:
|
3.7.4-3.7.16, 4.0.0-4.4.5 | |
| 2540040 |
Cumulus Linux uses VRRPv3 as the default version, and enables both preempt and accept mode by default. You cannot change these default values with NCLU. To work around this issue, run the vtysh commands (inside FRR) to change the default values. For example:
|
3.7.4-3.7.16, 4.0.0-4.4.5 | |
| 2540031 |
NCLU does not honor auto all in the /etc/network/interfaces file and removes the existing configuration if no individual auto lines exist. |
3.7.3-3.7.16, 4.0.0-4.4.5 | |
| 2539994 |
When you try to remove a BGP peer group configuration with NCLU, the command fails but no warning message is shown. For example:
|
3.7.2-3.7.16, 4.0.0-4.4.5 | |
| 2539962 |
When an LDAP user that does not have NCLU privileges (either in the netshow or netedit group, or in the /etc/netd.conf file) runs an NCLU command, a traceback occurs instead of a permissions error. |
3.7.0-3.7.16, 4.0.0-4.4.5 | |
| 2539670 |
On the Edgecore 4610-54P switch, automatic medium-dependent interface crossover (auto-MDIX) stops working on a 100M full duplex interface and does not detect the required cable connection type. |
3.7.2-3.7.16, 4.0.0-4.4.5 | |
| 2539124 |
The net add interface command adds no ptm-enable for that interface in the frr.conf file. Running the net add or the net del command does not remove no ptm-enable from the frr.conf file. You have to remove it manually using vtysh. |
3.7.2-3.7.16, 4.0.0-4.4.5 | |
| 2539081 |
When you delete post-up and pre-down IP peer entries from the etc/network/interfaces file, then run the ifreload command, the IP addresses are not removed and the route remains in the route table. To work around this issue, either delete the IP addresses without the /32 mask component or flush the IP addresses for the interface with the ip addr flush dev command. |
3.7.0-3.7.16 | 4.0.0-4.4.5 |
| 2538875 |
IPv6 multicast traffic destined to an unregistered multicast group is flooded to all ports in a bridge despite the bridge.optimized_mcast_flood = TRUE setting in the /etc/cumulus/swichd.conf file. |
3.7.2-3.7.16 | |
| 2538790 |
NCLU automatically adds the VLAN ID (for the layer 3 VNI/SVI) to the bridge when you run net add vxlan . This configuration breaks network connectivity in an EVPN symmetric routing configuration using MLAG. To restore connectivity, remove the VLAN ID from the bridge. |
3.7.2-3.7.16, 4.0.0-4.4.5 | |
| 2538590 |
When you configure a control plane ACL to define permit and deny rules destined to the local switch, NCLU programs the control plane ACL rules into the FORWARD chain. |
3.7.2-3.7.16, 4.0.0-4.4.5 | |
| 2538562 |
On an RMP/1G-T switch, when you remove link-speed 100 with the NCLU command or by editing the etc/network/interfaces file to revert the 100M interface to the default (1G auto), the interface fails to recover and does not come back up.After you remove the link-speed, ethtool shows the advertised link modes as not reported and Speed/Duplex as unknown.To work around this issue and bring the interface back up, either restart switchd or use ethtool to configure the speed, advertised, duplex or MDI-X settings. Note: The advertised link mode gets set incorrectly if you include 1000baseT/Half. The port will come up successfully at 1G. |
3.7.2-3.7.16, 4.0.0-4.4.5 | |
| 2538302 |
portwd allows an error to change the module type based on the error. For example, a bad write to a module might cause the module type to flap, which causes the link itself to flap. |
3.7.0-3.7.16 | |
| 2538294 |
If you use NCLU to create an iBGP peering across the peer link, running the net add bgp l2vpn evpn neighbor peerlink.4094 activate command creates a new eBGP neighborship when one has already been configured for iBGP. This is unexpected; the existing iBGP configuration is valid. |
3.7.0-3.7.16, 4.0.0-4.4.5 | |
| 2538256 |
On the Broadcom switch, when a link-local multicast frame is received on an access port with a VNI in the bridge, two copies of the packet are sent across the VNI to remote VTEPs and the receiving hosts observe duplicate packets. |
3.7.2-4.0.1 | 4.1.0-4.4.5 |
| 2537819 |
When you enable FEC (RS or BaseR) on an interface, removing the configuration from that interface does not revert the FEC status to off/none. |
3.7.2-3.7.16 | 4.0.0-4.4.5 |
| 2537699 |
There is a limitation on the number of SVI interfaces you can specify as DHCP relay interfaces in the /etc/default/isc-dhcp-relay file. For example, 1500 SVI interfaces causes the dhcrelay service to exit without a core file and logs similar to the following are generated for the interfaces:
Eventually the dhcrelay service stops. |
3.7.1-3.7.16, 4.0.0-4.4.5 | |
| 2537544 |
When you run the mstpctl command, you might see the bridge-port state as blocking when it is actually disabled. You might see the same incorrect bridge-port state when other programs or tools use the output of mstpctl; for example, SNMP output from the BRIDGE-MIB. |
3.7.1-3.7.16, 4.0.0-4.4.5 | |
| 2537378 |
NCLU SNMPv3 user configuration (add, delete, modify) does not complete. Changes are made to the /etc/snmp/snmpd.conf file but the SNMPv3 user cache file /var/lib/snmp/snmpd.conf fails to update correctly and the configuration does not reflect in operation. To work around this issue, stop snmpd, remove the cache file, then restart snmpd. |
3.7.1-3.7.16 | |
| 2537188 |
When an event in the network, such as a switchd or networking service restart, leads to an OVSDB server high availability transition, an ovs-vtepd core might occur. This core generation has no effect on the functionality of high availability when the active OVSDB server is back in the network. |
3.7.2-3.7.16 | |
| 2537104 |
When you try to stop hsflowd on the Trident II+ switch with the systemctl stop hsflowd command, the process hangs until you stop it with SIGKILL. |
3.7.1-3.7.16 | 4.0.0-4.4.5 |
| 2537061 |
The Dell S5048F-ON switch (with reverse airflow, rear to front), shows the Temp-3 sensor as absent. |
3.7.1-4.0.1 | 4.1.0-4.4.5 |
| 2536608 |
Single tagged ARP requests received on a QinQ-over-VXLAN access port are dropped if ARP suppression is enabled on an unrelated VNI. |
3.7.0-3.7.16 | |
| 2536384 |
The BFD packet redirection logic used by OVSDB server high availability mode redirects BUM packets across the peer link. The iptables rule for redirection does differentiate between BFD and non-BFD VXLAN inner packets because the service node sends all frames with its own IP address as the tunnel source IP address. The VXLAN encapsulated BUM packets do not get forwarded to the CPU and do not go through the iptable redirection rule; only VXLAN encapsulated BFD packets get forwarded to the CPU due to the inner MAC DA lookup in hardware. |
3.7.0-3.7.16, 4.0.0-4.4.5 | |
| 2536179 |
On switches with the Trident 2+ ASIC, counters associated with VLANs and VRFs are not working. | 3.7.0-3.7.16, 4.0.0-4.4.5 | |
| 2535986 |
At a high CPU transmit traffic rate (for example, if there is unexpected CPU generated flooding or replication in software), when the ASIC packet driver cannot keep up with the transmit rate because there are no free DMA buffers, it can back pressure by suspending the switch port transmit queues. This can fill up the application socket buffers resulting in No buffer space available error messages on protocol sockets.When the driver recovers, it automatically resumes the transmit queues. In most cases these error messages are transient. In rare cases, the hardware queues might get stuck, which you can recover with a switchd restart. |
3.7.0-3.7.16, 4.0.0-4.4.5 | |
| 2535965 |
On the Trident3 switch, static PIM with IIF based on a layer 2 bridge does not work reliably. PIM Join via signaling is required for IPMC to work properly. To work around this issue, use dynamic signaling (joins) to manage IP multicast traffic. |
3.7.0-3.7.16, 4.0.0-4.4.5 | |
| 2533691 |
If you configure a VLAN under a VLAN-aware bridge and create a subinterface of the same VLAN on one of the bridge ports, the bridge and interface compete for the same VLAN and if the interface is flapped, it stops working. Correcting the configuration and running the ifreload command does not resolve the conflict. To work around this issue, correct the bridge VIDs and restart switchd or delete the subinterface. |
3.7.12-3.7.16, 4.0.0-4.4.5 | |
| 2532017 |
In FRR, bgp_snmp does not show all BGP peers when peer groups used. |
3.7.11-4.0.1 | 4.1.0-4.4.5 |
Fixed Issues in 3.7.13
| Issue ID | Description | Affects |
|---|---|---|
| 2552134 |
When the MLAG peerlink flaps on Broadcom Trident3 platforms, switchd might continually sync route and neighbor entries to hardware. This can be observed in /var/log/switchd.log with repeated Neighbor Summary and IPv4 Route Summary updates:sync_route.c:2063 Neighbor Summary : 0 Added, 0 Deleted, 501 Updated, 0 Skipped in 589761 usecs |
3.7.12 |
| 2551708 |
On the Mellanox switch with the Spectrum and Spectrum-2 ASIC, IPv6 egress ACLs are not supported on subinterfaces. | |
| 2551543 |
switchd might crash if more than 16 IPv6 default route next hops are installed in the kernel routing table and those 16 next hops recurse to MAC address table entries reachable over VXLAN VNI interfaces. This can occur when many IPv6 router advertisements (RAs) are received across VLAN interfaces that have IPv6 forwarding disabled.To work around this issue, add the following parameters to the /etc/sysctl.conf file to disable IPv6 default route installation from received router advertisements, then run the sudo sysctl -p –system command.
|
3.7.12 |
| 2551161 |
switchd memory utilization might continue to increase if there are excessive and continuous link flaps over a long period of time.To work around this issue, correct the cause of the frequent link flaps. You can restart switchd with the sudo systemctl restart switchd command to recover memory; this operation is impactful to all traffic on the switch during the restart. |
3.7.11-3.7.12, 4.0.0-4.2.0 |
| 2550323 |
After a neighbor is removed, the redistributed neighbor entry is withdrawn from the BGP table, but the prefix might still be selected as the bestpath when the host’s originated prefix is not advertised. To work around this issue, recreate the neighbor entry and flap the interface to the host. Or, if the host is already down, manually create a neighbor entry with an invalid MAC address, which forces redistribute neighbor to re-withdraw the entry. |
3.7.3-3.7.12 |
| 2550274 |
If packets with an invalid checksum are received, the cumulus-poe service might restart and you see log messages similar to the following:May 20 10:48:04.665635 leaf01 poed[8012]: ERROR : invalid checksum in response [0xC2:0x00] May 20 10:48:04.671299 leaf01 poed[8012]: poed : ERROR : invalid checksum in response [0xC2:0x00] May 20 10:48:04.708620 leaf01 systemd[1]: cumulus-poe.service: main process exited, code=exited, status=1/FAILURE The service starts automatically but there is an impact to POE devices momentarily. |
3.7.12, 4.0.0-4.1.1 |
| 2549676 |
After you add or remove a bridge VLAN identifier (VID) on a trunk port, the layer 2 VNI is put into VLAN 1. To work around this issue, revert the configuration change. |
3.7.10-3.7.12, 4.0.0-4.1.1 |
| 2549397 |
When the BGP Multi-protocol Unreach NLRI attribute is received in a BGP update without a next hop attribute, the BGP session is brought down unexpectedly. RFC 4760 defines that the next-hop attribute is not required for updates containing MP_UNREACH_NLRI. | 3.7.12 |
| 2548673 |
A large number of flapping peers causes FRR to require a corresponding update to internal data structures that track peer information. Updating this internal data structure does not delete links that are down due to the flapping. The size of this array then grows to contain both current peers as well as peers that should have been deleted during the flap processing. The contents of this array is processed by FRR to poll the links, which consumes CPU for all items in the array. This additional polling consumes more CPU than necessary but has no functional impact. To work around this issue, restart FRR. |
3.7.11-3.7.12, 4.0.0-4.1.1 |
| 2548659 |
When a link flap occurs while IPv6 traffic traverses interfaces, a kernel panic may occur with the following logs printed to the console:
|
3.7.12 |
| 2548585 |
After you flap an MLAG peerlink, a rare condition might occur where routes and neighbors for VXLAN-enabled VLANs are misprogrammed as non-VXLAN routes and neighbors due to VNI state transitions. This results in a forwarding failure for traffic destined to these misprogrammed routes and neighbors. Note: Do not flap a VNI interface manually. The only expected time for a VNI interface to go down is when the MLAG secondary switch brings the VNIs protodown during a peer link failure where the backup IP address is still active. To recover from this condition, restart switchd with the sudo systemctl restart switchd command. |
3.7.10-3.7.12, 4.1.0-4.1.1 |
| 2548382 |
The QuantaMesh BMS T3048-LY8 switch shows a low fan RPM in syslog. | 3.7.5-3.7.12, 4.0.0-4.1.1 |
| 2548372 |
On the Edgecore AS5812 switch, the Innodisk DIMM causes a DIMM temperature sensor absent alert. | 3.7.12, 4.0.0-4.1.1 |
| 2548307 |
When the garbage collector does not release memory back to the operating system, clagd might consume a large amount of memory. As a result of low system memory, systemd might shut down services to reclaim memory. |
3.7.11-3.7.12, 4.1.0-4.1.1 |
| 2548116 |
The OVSDB log contains duplicate MAC addresses with the well-known BFD MAC address (00:23:20:00:00:01). This is mainly cosmetic, but clutters the log. | 3.7.12, 4.0.0-4.0.1 |
| 2548112 |
In OVSDB VLAN-aware mode, removing a VTEP binding on the NSX controller fails to clean up all interfaces associated with the logical switch. | 3.7.12, 4.0.0-4.1.1 |
| 2548111 |
When you remove, then re-add an NSX VTEP binding, the VXLAN VTEP interface is not recreated. | 3.7.9-3.7.12, 4.0.0-4.0.1 |
| 2547769 |
syslog might report a high load average with the CPU running a later microcode revision. |
3.7.4-3.7.12 |
| 2547666 |
On the Dell S5232F-ON switch, the output of ledmgrd shows amber_blinking but smonctl shows all OK. |
3.7.11-3.7.12, 4.0.0-4.1.1 |
| 2547663 |
When traffic from a double tag interface (facing a different site) is forwarded through VXLAN, the inner tag is not removed. The destination does not know this tag, so it discards it. | 3.7.8-3.7.12, 4.0.0-4.0.1 |
| 2547658 |
On the Lenovo NE0152T switch, one power supply (PSU2) always show as ABSENT in smonctl. | 3.7.11-3.7.12 |
| 2547609 |
Mellanox switches with the Spectrum A0 ASIC that are integrated with VMware NSX experience BFD connectivity issues with service nodes. As a result, VXLAN tunnels do not work. Mellanox switches with the Spectrum A1 ASIC do not have this issue. |
3.7.11-3.7.12, 4.0.0-4.1.1 |
| 2547592 |
When you add a route map to advertise IPv4 unicast in a BGP EVPN configuration and the route map contains a set operation, BGP crashes. | 3.7.11-3.7.12 |
| 2547293 |
On the Broadcom Trident3 switch with DHCP relay, where the DHCP server is reachable through the EVPN overlay, DHCP discover packets forwarded to the CPU might appear corrupt and might not get forwarded. | 3.7.9-3.7.12, 4.0.0-4.0.1 |
| 2547147 |
The ospfd daemon might crash with the following kernel trace:
|
3.7.11-3.7.12, 4.0.0-4.0.1 |
| 2546984 |
On the EdgeCore AS7326-56X switch, the PSU fans show constant LOW warnings. | 3.7.10-3.7.12, 4.0.0-4.2.0 |
| 2546950 |
switchd crashes when dynamic VRF route leaking is enabled and the following is true:* The default route is leaked from VRF1 to VRF2 * Hardware-based dynamic VRF route leaking is configured ( vrf_route_leak_enable_dynamic is set to TRUE in the /etc/cumulus/switchd.conf file). You might see logs similar to the following in /var/log/syslog:
To work around this issue, use a route map to filter the default route (the source VRF is imported into the destination VRF). |
3.7.10-3.7.12, 4.0.0-4.1.1 |
| 2546141 |
CPU usage might be higher than normal if you have a high number of interfaces x VLANs and lldpd is active. This issue is introduced with code changes in Cumulus Linux 3.7.11, where VLAN information is now available for LLDP to advertise to neighbors ([https://docs.cumulusnetworks.com/version/cumulus-linux-37/Layer-2/Link-Layer-Discovery-Protocol/#vlan-dot1-tlv]). You might see high CPU usage even if VLAN (dot1) TLV configuration is disabled. To check if lldpd is the heavy CPU resource user, run the following command:
Alternatively, check for messages in the /var/log/syslog directory similar to:
Note: The exact amount of CPU usage varies in each network based on a number of factors; however, it is unusual for lldpd to consume more than 30% CPU for an extended period of time.To work around this issue, you can do one of the following: * If the large number of VLANs is not absolutely necessary, manually prune the VLAN allowed list (if you use the range 1-2999, modify the bridge-vids list to include the VLANs being used).* Stop the lldpd service. (This approach might be undesirable if the switch is providing services that rely on LLDP such as Voice VLAN.) To stop the lldpd service (runtime setting), run the sudo systemctl stop lldpd.service command. To disable the lldpd service upon boot, run sudo systemctl disable lldpd.service. |
3.7.11-3.7.12, 4.0.0-4.0.1 |
| 2543792 |
On the EdgeCore AS5712, AS6712, AS5812 and AS6812 switch, support for multiple PSU types results in log messages similar to the following:
|
3.7.9-3.7.12, 4.0.0-4.0.1 |
| 2543648 |
You cannot specify a source and destination MAC address in an ERSPAN ebtables rule. For example, the following rule does not work:
|
3.7.6-3.7.12, 4.0.0-4.1.1 |
| 2543472 |
On switches with the Spectrum ASIC, the underlay hashes VXLAN packets for a given overlay flow randomly. To work around this issue, configure the ECMP hash seed to the same value on the EVPN egress leaf switches. |
3.7.7-3.7.12, 4.0.0-4.0.1 |
| 2542767 |
If the BMC operating system fails to respond to IPMI, you see a traceback in bmcd and all the sensors might report ABSENT devices in smonctl. To work around this issue, power cycle the switch. |
3.7.6-3.7.12, 4.0.0-4.0.1 |
| 2535845 |
On a Trident3 switch, IGMP packets are not policed by the police rule in the 00control ACL file. The packets are policed by the catchall policer in the 99control ACL file instead. -A $INGRESS_CHAIN -p ipv4 -d 01:00:5e:00:00:00/ff:ff:ff:80:00:00 -j police –set-mode pkt –set-rate 100 –set-burst 100 To work around this issue, let the CPU bound IGMP packet hit the following rule and change the policer rate to a desired value for IGMP packets: -A $INGRESS_CHAIN -p ipv4 -d 01:00:5e:00:00:00/ff:ff:ff:80:00:00 -j police –set-mode pkt –set-rate 100 –set-burst 100 Typically, the destination MAC address 01:00:5e:xx:xx:xx is used only for PIM/IGMP control and data stream packets. However, this workaround cannot handle data stream multicast packets that are not TCP/UDP; this is not typically done. |
4.0.0-4.0.1 |
3.7.12 Release Notes
Open Issues in 3.7.12
| Issue ID | Description | Affects | Fixed |
|---|---|---|---|
| 3410952 |
If MLAG is configured but disconnected from an MLAG peer for an extended period of time (days or more), there is a long delay (up to a minute per day) before traffic forwarding stabilizes after the MLAG peer connection re-establishes. | 3.7.0-4.3.1 | 4.3.2-4.4.5, 5.5.0-5.15.0 |
| 3376798 |
On Broadcom switches, Cumulus Linux does not create the hardware bridging domain for a traditional bridge with a VXLAN interface during switchd restart. The /var/log/switchd.log file includes the following exception logs shortly after switchd restarts:switchd[30158]: hal_bcm_l3.c:1617 find_egr_path_if_vxlan_overlay:vxlan overlay : nh PORT: port <#>, vlanMAC learning looks correct, but traffic does not flow as expected. |
3.7.0-4.3.1 | 4.3.2-4.4.5 |
| 3330705 |
When using TACACS+, a TACACS+ server name that returns more than one IP address, such as an IPv6 and IPv4 address, is counted many times against the limit of seven TACACS+ servers, which might cause some of the later listed servers to be ignored as over the limit. To work around this issue, you can set the prefer_ip_version configuration option (the default value is 4) to choose between an IPv4 or IPv6 address if both are present. |
3.7.0-5.3.1 | 5.4.0-5.15.0 |
| 3327477 |
If you use su to change to a user specified through TACACS+, the user becomes the local tacacs0 thru tacacs15 user instead of the named user to run sudo commands. As a result, the named user password might not match the local tacacs0 thru tacacs15 user password. |
3.7.0-3.7.16, 4.0.0-4.4.5, 5.0.0-5.15.0 | |
| 3216921 |
RADIUS authenticated users with read-only access to NCLU commands (users in the users_with_show list) can run edit commands if a username for a non-local account is on the users_with_edit line of the /etc/netd.conf file. To work around this issue, make sure that all usernames on the users_with_edit line of the /etc/netd.conf file are configured local users for the system (real Linux users) |
3.7.0-3.7.16, 4.3.0-4.4.5 | |
| 3209699 |
RADIUS authenticated users with read-only access to NCLU commands (users in the users_with_show list) can run edit commands if a username for a non-local account is on the users_with_edit line of the /etc/netd.conf file. To work around this issue, make sure that all usernames on the users_with_edit line of the /etc/netd.conf file are configured local users for the system (real Linux users) |
3.7.0-4.3.0, 4.4.0-5.2.1 | 4.3.1, 5.3.0-5.15.0 |
| 3135801 |
Zebra rejects MAC IP updates from BGP when the MAC mobility sequence number that BGP sends is lower than the sequence number known to zebra When the MAC mobility sequence that BGP knows legitimately lowers (due to narrow timing conditions during convergence or after rebooting an MLAG pair one VTEP at a time), zebra rejects these updates and maintains a stale state. If the stale information that zebra uses points to the wrong VTEP address, traffic goes to the wrong VTEP and might drop. |
3.7.12-4.3.0 | 4.3.1-4.4.5 |
| 3073668 |
On the EdgeCore AS4610 switch, when you change the speed of any of the SFP+ ports, the other SFP+ ports flap. | 3.7.12-3.7.16, 4.3.0-4.4.5 | |
| 3017190 |
When you power cycle the switch, multiple interfaces came up in a PoE disabled state To work around this issue, run the sudo poectl -a | grep disabled command to find ports with disabled POE. Run the sudo poectl -e swp1-swp48 command to enable POE on affected ports. |
3.7.10-3.7.16 | |
| 2940076 |
In a VXLAN fabric with ToR switches configured in a MLAG pair, BUM traffic received on a VXLAN tunnel is decapsulated and forwarded on the peer link bond. The BUM traffic is then encapsulated by the peer switch and sent back to the fabric. The issue has been seen in environments where the following conditions exist at the same time:1) high VNI scale2) switchd is busy processing updates3) clagd is in a transition state, such as Up, then Down, then Up. For example, when clagd restarts, the switch reboots, and so onThe problem is seen on the switch that experiences the clagd state transition. |
3.7.12-3.7.15 | 3.7.16 |
| 2940063 |
Under certain high scale conditions, various modules might experience timetouts during cl-support collection, which results in missing data in the cl-support file. | 3.7.12-3.7.15, 4.1.1-4.3.0 | 3.7.16, 4.3.1-4.4.5, 5.0.0-5.15.0 |
| 2934939 |
When you configure BGP aggregate-address summary-only and any component route within the summary updates, all component routes within the summary update in the RIB on the device advertising the summary. This condition might result in increased CPU usageTo workaround this issue, remove the aggregate-address summary-only configuration, add a static route to Null0 for the prefix, and configure an outbound route map to restrict anything more specific than the desired prefix from being advertised. For example: Before:address-family ipv4 unicastAfter: ip route 10.10.0.0/16 Null0This example assumes no other static routes are present. Otherwise, you might need to configure additional route maps to limit the static routes being redistributed. |
3.7.12-3.7.16 | |
| 2866084 |
When you reboot a VTEP, MAC address entries might become out of sync between the kernel FDB table and the EVPN MAC VNI table on remote VTEPs. The impacted MAC entries are installed against the rebooted VTEP IP address in the kernel FDB and the correct VTEP IP is present in the EVPN MAC VNI table. To work around this issue, clear all corrupted MAC address entries in the kernel FDB with the bridge fdb del dev command, then add “vxlan-learning”: “off” in the /etc/network/ifupdown2/policy.d/vxlan.json file:$ cat /etc/network/ifupdown2/policy.d/vxlan.jsonReboot the affected switches. |
3.7.12-4.3.0 | 4.3.1-4.4.5 |
| 2866061 |
On the Maverick S4148T switch with MLAG, Cumulus Linux drops LACP, ARP, LLDP and BGP traffic. | 3.7.12-3.7.16 | |
| 2815592 |
In an EVPN configuration, an FRR restart on a border leaf VRRP master causes a stale route for the VRRP VIP on some remote VTEPs to point to the VRRP backup after convergence. | 3.7.12-3.7.15, 4.3.0, 4.4.2-5.0.1 | 3.7.16, 4.3.1, 5.1.0-5.15.0 |
| 2801262 |
On NVIDIA Spectrum ASICs in a layer 2 bridge scaled configuration (more than 800 VLANs), clagd.service enters a failed state after a reboot or a switchd restart. |
3.7.12-3.7.15, 4.3.0, 4.4.2-4.4.5 | 3.7.16, 4.3.1, 5.0.0-5.15.0 |
| 2794750 |
When a multipath route that contains an EVPN path exists together with an IPv4 BGP path in the VRF, the RMAC to VTEP binding is incorrect. This invalid entry occurs because Cumulus Linux treats IPv4 routes received over the eBGP IPv4 peering incorrectly in the VRF. To work around this issue, remove the unnecessary eBGP IPv4 peering. |
3.7.12-4.2.1 | 4.3.0-4.4.5 |
| 2736265 |
After an apt upgrade, the OPTIONS configuration line in /etc/default/isc-dhcp-relay might be removed. To work around this issue, reconfigure the desired options in the file after the upgrade completes. |
3.7.12-4.3.0 | 4.3.1-4.4.5, 4.4.0-4.4.5 |
| 2730225 |
When withdrawal and advertisement processing occurs in short succession, type-2 routes with an IP are not imported into layer 2 VNIs. | 3.7.12-4.3.0 | 4.3.1-4.4.5, 4.4.2-4.4.5 |
| 2700767 |
Following an event that causes the peerlink bond MAC address to change, such as a slave port state change, MLAG interfaces might be suspended due to a peer IP mismatch. This behavior is seen when you use a MLAG peer IP linklocal configuration. | 3.7.12-3.7.15, 4.3.0-4.4.5 | 3.7.16 |
| 2687332 |
When you configure BGP aggregate-address summary-only and any component route within the summary updates, all component routes within the summary update in the RIB on the device advertising the summary. This condition might result in increased CPU usageTo workaround this issue, remove the aggregate-address summary-only configuration, add a static route to Null0 for the prefix, and configure an outbound route map to restrict anything more specific than the desired prefix from being advertised. For example: Before:address-family ipv4 unicastAfter: ip route 10.10.0.0/16 Null0This example assumes no other static routes are present. Otherwise, you might need to configure additional route maps to limit the static routes being redistributed. |
3.7.12-4.2.1 | 4.3.0-4.4.5 |
| 2684452 |
When a VTEP is rebooted, MAC address entries might become out of sync between the kernel fdb table and the EVPN MAC VNI table on remote VTEPs. The impacted MAC entries will be installed against the rebooted VTEP IP in the kernel fdb and the correct VTEP IP will be present in the EVPN MAC VNI table You can work around this issue with the following steps:1. Clear all corrupted mac entries in the kernel FDB with the bridge fdb del dev command2. Add “vxlan-learning”: “off” under /etc/network/ifupdown2/policy.d/vxlan.json$ cat /etc/network/ifupdown2/policy.d/vxlan.json3. Reboot the affected switch(es) |
3.7.12-3.7.16 | |
| 2669438 |
Editing the /etc/frr/frr.conf file to add a new sequence at the beginning of an existing large prefix list changes the subsequent sequence numbers of the next entries in the list and FRR reload might fail with the error message frr.service reload operation timed out. Stopping. To work around this issue, instead of adding the new prefix using an existing sequence number and pushing other sequences forward, use a sequence number that is free; for example, instead of of using 5 -> 10 -> 15, use 5 -> 7 -> 10. |
3.7.11-3.7.16 | |
| 2660582 |
In an MLAG configuration, the secondary MLAG switch does not use a unique address instead of the MLAG system MAC address when there is a double failure (backup IP and peer link failure) To recover restart the clagd service with sudo systemctl restart clagd.service |
3.7.8-3.7.15 | 3.7.16 |
| 2653400 |
When 802.1x MAB and a parking VLAN are configured on an interface, hostapd might install a static fdb entry if the interface is down. To work around this issue, delete 802.1x from the interface with the net del interface command, then add back the 802.1x configuration. |
3.7.10-3.7.16 | |
| 2645846 |
When 802.1x MAB and a parking VLAN are configured on an interface, hostapd might install a static fdb entry if the interface is down. To work around this issue, delete 802.1x from the interface with the net del interface command, then add back the 802.1x configuration. |
3.7.10-3.7.15 | 3.7.16, 4.3.1-4.4.5 |
| 2633245 |
On the Dell N3048EP-ON switch, the SPF+ ports remain down after a power cycle. | 3.7.10-3.7.16 | |
| 2599607 |
In some corner cases, remote MAC entries may be seen as locally learnt entries in FDB table due to switchd reprogramming it | 3.7.12-4.3.0 | 4.3.1-4.4.5, 4.4.4-4.4.5, 5.0.0-5.15.0 |
| 2595889 |
In a traditional bridge configuration with ip-forward off, neighbors are synchronized to hardware with a switchd restart but are cleared when you flap the bridge interface. |
3.7.10-4.2.1 | 4.3.0-4.4.5 |
| 2595816 |
Tenant VRF BGP peers appear in the EVPN RMAC and nexthop tables, which causes the kernel RMAC to point at invalid IP address. | 3.7.12-4.2.1 | 4.3.0-4.4.5 |
| 2589747 |
If switchd successfully signals clagd that it is going down, clagd stops responding to keepalive echo requests from the peer instead of sending a good bye to the peer over both the peerlink and the backup switch. Eventually, the keepalive timer expires and the secondary switch becomes the primary, and brings the bonds and VNIs back up. However, if switchd does not successfully signal it is going down, (in the event of a crash), the primary switch continues to respond to keepalives, and the bonds and VNIs are down on both peers. |
3.7.12-4.2.1 | 4.3.0-4.4.5 |
| 2562511 |
hostapd does not fail over to secondary RADIUS servers for 802.1x authentication when the primary radius is reachable but not responding to Access-RequestsIf the primary RADIUS server is having a problem servicing requests, you can remove it from the configuration temporarily to force requests to be sent to alternate servers. |
3.7.10-3.7.14.2 | 3.7.15-3.7.16 |
| 2556233 |
Some ECMP next-hops might fail installation into hardware at high ECMP group and route scale. The following log message will be observed when this condition occurs:WARN xx routes reverted to non-ECMP due to NH table capacity |
3.7.9-3.7.14.2 | 3.7.15-3.7.16 |
| 2556037 |
After you add an interface to the bridge, an OSPF session flap might occur |
3.7.9-4.2.0 | 4.2.1-4.4.5 |
| 2556019 |
After you add an interface to a bridge using the NCLU net add bridge bridge ports command, the bridge can go down and its MAC address changesTo work around this issue, use Linux commands to add an interface to a bridge. |
3.7.9-3.7.13 | 3.7.14-3.7.16 |
| 2555908 |
If the you add the MLAG backup IP address to the MLAG peer in the secondary role while the peer link is down, the LACP sys-mac does not use the MLAG system MAC address (clagd-sys-mac) when the peer link comes back up To work around this issue, wait until the peer link is up to add the MLAG backup IP address. To recover from this condition, restart clagd with the sudo systemctl restart clagd command. |
3.7.12-4.0.1 | 4.1.0-4.4.5 |
| 2554785 |
After you reboot a Broadcom switch, switchd might fail to restart and you see logs in switchd.log similar to the following:Nov 12 12:20:05.063876 leaf01 switchd[9867]:Nov 12 12:20:05.064310 leaf01 switchd[9867]: hal_bcm_console.c:294 0:system_init:Nov 12 12:20:05.064428 leaf01 switchd[9867]: hal_bcm_console.c:294 system_init: Misc init failed: Operation timed outNov 12 12:20:05.064464 leaf01 switchd[9867]:Nov 12 12:20:05.091995 leaf01 switchd[9867]: hal_bcm_console.c:294 LED: Loading 256 bytes into LED program memoryNov 12 12:20:05.092029 leaf01 switchd[9867]:Nov 12 12:20:05.099547 leaf01 switchd[9867]: hal_bcm_console.c:294 PORT: Error: bcm ports not initializedNov 12 12:20:05.099579 leaf01 switchd[9867]:Nov 12 12:20:05.099646 leaf01 switchd[9867]: hal_bcm_console.c:294 Error: file /var/lib/cumulus/rc.datapath_0: line 81 (error code -1): script terminatedNov 12 12:20:05.099667 leaf01 switchd[9867]:Nov 12 12:20:05.099775 leaf01 switchd[9867]: hal_bcm_console.c:294 Error: file /etc/bcm.d/rc.soc: line 70 (error code -1): script terminatedNov 12 12:20:05.099798 leaf01 switchd[9867]:Nov 12 12:20:05.099871 leaf01 switchd[9867]: hal_bcm_console.c:294 ERROR loading rc script on unit 0Nov 12 12:20:05.099892 leaf01 switchd[9867]:Nov 12 12:20:05.099943 leaf01 switchd[9867]: hal_bcm_console.c:299 CRIT loading of rc script failed, aborting!To work around this issue, configure Cumulus Linux to boot with the ntel_iommu=off kernel command option:1. Open the /etc/default/grub file with a text editor2. Edit the GRUB_CMDLINE_LINUX variable by adding the string intel_iommu=off at the end. For example: GRUB_CMDLINE_LINUX=“cl_platform=cel_e1031 console=ttyS1,115200n8 intel_iommu=off"3. Run the update-grub command4. Reboot the switch. |
3.7.11-4.2.1 | 4.3.0-4.4.5 |
| 2554719 |
A slow memory leak is observed (1% per 14 hours) in kmalloc-256. To work around this issue, reboot the switch. |
3.7.12-3.7.14.2 | 3.7.15-3.7.16 |
| 2554369 |
Certain Dell S4048-ON switches show an incorrect vendor name and hang when you issue the reboot command. |
3.7.12-4.2.1 | 4.3.0-4.4.5 |
| 2554329 |
On the Dell N3248PXE switch, fixed RJ45 interfaces with PoE neighbors can end up in Paused mode after a switchd restart, which blocks traffic on that interface. |
3.7.12-3.7.16 | |
| 2554232 |
VXLAN encapsulated traffic is not routed to the next hop because the destination VTEP IP address is mis-programmed on the switch, which decapsulates the traffic unexpectedly. To work around this issue, restart switchd. |
3.7.12-3.7.13 | 3.7.14-3.7.16 |
| 2553887 |
When using TACACS+ configured with a DEFAULT user providing privilege level lower than 16, TACACS+ configured users with privilege level 16 access might not be able to run privilege level 16 NCLU commands, such as net add and net del and see an error similar to the following:
To work around this issue, remove the DEFAULT user from the TACACS+ server. |
3.7.7-3.7.16, 4.0.0-4.4.5 | |
| 2553748 |
On switches with the Spectrum ASIC, the IPv6 default route is present in the kernel but missing in hardware. | 3.7.11-4.2.1 | 4.3.0-4.4.5 |
| 2553732 |
A ping via a dual-connected bond fails, and the audio stream is not routed or encapsulated through the layer 3 VNI. | 3.7.12-4.2.1 | 4.3.0-4.4.5 |
| 2553588 |
Multicast traffic on a VPN is sent to remote VTEPs that are not part of the VPN and the remote VTEPs receive multicast traffic encapsulated in a VXLAN ID that doesn’t exist. To work around this issue, disable IGMP snooping on the switch. |
3.7.12-4.2.1 | 4.3.0-4.4.5 |
| 2553530 |
In an MLAG configuration with a layer 3 VNI, when you bounce the peer link, all layer 2 VNIs listed under the layer 3 VNI are duplicated. To work around this issue, restart FRR with the sudo systemctl restart frr.service command. |
3.7.10-4.2.1 | 4.3.0-4.4.5 |
| 2553450 |
On the the Dell N3248-PXE switch, when you insert two PSUs at different times, the newly inserted PSU is detected as OK but the fan and temp sensors are ABSENT. To work around this issue, remove power to both PSUs at the same time, then reinsert power simultaneously. |
3.7.12-4.2.1 | 4.3.0-4.4.5 |
| 2553229 |
On the Dell N3248PXE switch, RJ45 fixed copper ports that auto-negotiate with a 100M or 10M neighbor incorrectly negotiate a half-duplex link that generates errors. Half duplex modes are not supported on this platform. | 3.7.12-4.2.1 | 4.3.0-4.4.5 |
| 2553219 |
You cannot configure SNMPv3 trap-destinations in non-default VRFs with an authentication username that contains fewer than eight characters. | 3.7.12-4.2.1 | 4.3.0-4.4.5 |
| 2553116 |
When you manually set the link speed or duplex mode with ethtool to an unsupported value, then run a TDR check against the interface, you encounter a switchd service heartbeat failure.To work around this issue, reboot the switch to clear the condition. Avoid setting the interface speed or duplex mode directly with ethtool. |
3.7.12-3.7.16, 4.0.0-4.4.5 | |
| 2553050 |
SNMP status might incorrectly reflect that a BGP neighbor is down due to an issue between bgpd and SNMP AgentX when the IP-FORWARD-MIB is also polled.To work around this issue, avoid polling IP-FORWARD-MIB objects. |
3.7.12-3.7.16 | |
| 2553015 |
If a neighbour contains a special character in PortID for LLDP, the net show interface command does not display the LLDP information or the command might fail. |
3.7.10-3.7.16, 4.2.0-4.4.5 | |
| 2553001 |
When the following conditions exist, clagd might fail to establish a TCP control session across the subinterface (such as, peerlink.4094): * clagd uses an IPv6 link-local address (LLA) to establish the TCP connection (the clagd-peer-ip linklocal command configures an IPv6 LLA connection)* Subsequent VLAN changes are made to VLAN sub-interfaces or adding or removing SVIs This issue occurs because the hardware stores one entry per VRF to represent the IPv6 LLA. The hardware entry for the LLA is removed when another interface is changed because the software interfaces are represented by a single entity in hardware. As a result, packets destined to the local IPv6 LLA address are received on the port but do not get forwarded to CPU for further processing. To workaround this issue, use IPv4 addresses under peerlink.4094 and configure clagd to peer on IPv4 addresses. |
3.7.12-4.1.1 | 4.2.0-4.4.5 |
| 2552939 |
RX_DRP on a bond interface increases without any data traffic while the slave port does not increase. | 3.7.12-4.2.1 | 4.3.0-4.4.5 |
| 2552925 |
On the EdgeCore AS-6712-32X, AS5812-54X and AS5812-54T switch models, the temp sensors (DIMM temp sensor) show ABSENT. The amber diagnostic light on the front of the switch might also be turned on due to this issue. These messages and the light are cosmetic issues only and do not otherwise impact the function of the switch. |
3.7.12-3.7.13 | 3.7.14-3.7.16 |
| 2552742 |
On the Mellanox SN2410 switch, you see switchd core and GBIN_MALLOC errors.To work around this issue, restart switchd. |
3.7.12-4.2.1 | 4.3.0-4.4.5 |
| 2552739 |
Counters for IPROUTER rules do not increase when traffic is forwarded to the CPU because there is no IP neighbor. | 3.7.2-3.7.16 | |
| 2552647 |
When you add a member to a bond that has a subinterface configured (such as peerlink.4094), the new member is assigned only the VLAN of the subinterface for forwarding. To work around this issue, bounce the bond or shutdown the new interface and use the remaining members over the bond. |
3.7.10-4.2.0 | 4.2.1-4.4.5 |
| 2552528 |
Ingress SPAN/ERSPAN does not mirror packets when the next hop is EVPN encapsulated. | 3.7.7-4.2.1 | 4.3.0-4.4.5 |
| 2552506 |
Changing the order of the bridge ports might cause the bridge MAC address to change, which flaps the bridge and its ports. To work around this issue, manually set the MAC address of the bridge interface by adding hwaddress to the bridge stanza in the /etc/network/interfaces file. |
3.7.11-4.2.0 | 4.2.1-4.4.5 |
| 2552294 |
NCLU restarts FRR when removing a BGP VRF IPv4 aggregate-address command. |
3.7.12-3.7.16, 4.0.0-4.4.5 | |
| 2552214 |
The Mellanox SN2700 and SN2410 switch intermittently reports PSU fan state changes with Unable to read from device/fan1_input/pwm1 syslog messages. |
3.7.11-3.7.14.2, 4.1.1-4.3.0 | 3.7.15-3.7.16, 4.3.1-4.4.5, 4.4.0-4.4.5 |
| 2552205 |
If the MAC address of an SVI changes, clagd does not update its permanent neighbor entry for the local interface, and it does not report the change to its MLAG peer. This leaves the MLAG peer in a state where its permanent neighbor for the MLAG peer’s SVI IP address continues to use the old MAC address, which causes routed traffic over this SVI to be dropped.To work around this issue, ifdown/ifup the SVI when a MAC address changes. |
3.7.12-4.2.0 | 4.2.1-4.4.5 |
| 2552134 |
When the MLAG peerlink flaps on Broadcom Trident3 platforms, switchd might continually sync route and neighbor entries to hardware. This can be observed in /var/log/switchd.log with repeated Neighbor Summary and IPv4 Route Summary updates:sync_route.c:2063 Neighbor Summary : 0 Added, 0 Deleted, 501 Updated, 0 Skipped in 589761 usecs |
3.7.12 | 3.7.13-3.7.16 |
| 2551911 |
ifupdown2 does not account for link status or link down configuration when running dhclient. For example, ifupdown2 ignores link-down yes during ifup/ifreload and runs the DHCP module if inet dhcp is configured on the interface. ifupdown2 also runs the DHCP module even when the physical link configured for DHCP is down. |
3.7.12-4.2.0 | 4.2.1-4.4.5 |
| 2551748 |
In OVSDB high availability mode, deleting > 200 VLAN bindings might cause ovs-vtepd to crash. Limit the deletion to 200 or fewer VLAN bindings. |
3.7.12-4.2.1 | 4.3.0-4.4.5 |
| 2551731 |
When the OVSDB VTEP scale increases, the CPU utilization increases and eventually the switch (ptmd) fails to respond to the BFD, causing the BFD session to go down. As a result OVSDB cannot read the BFD socket status and outputs a warning in the ovs-vtepd debugs: PTM socket error: Bad file descriptor. |
3.7.12-4.2.0 | 4.2.1-4.4.5 |
| 2551728 |
In OVSDB high availability mode, if you create, then delete a binding, the FDB entry is not replaced and you see an error. | 3.7.12-4.2.0 | 4.2.1-4.4.5 |
| 2551714 |
There is a change to the default OVSDB bootstrapping process, where the script created now defaults to VLAN-aware bridge mode. If you want to use traditional bride mode, you need to force it by editing the ovs-vtep-ctl script generated by the bootstrap process. |
3.7.12-4.2.0 | 4.2.1-4.4.5 |
| 2551693 |
A host migrated to an 802.1X MAB port within the same broadcast domain fails to have the correct FDB entry installed if a dynamic FDB entry for that MAC address exists from previous connectivity in the broadcast domain. To work around this issue, manually delete the dynamic FDB entry that is associated with the uplink trunk port. |
3.7.12-4.2.0 | 4.2.1-4.4.5 |
| 2551675 |
When you restart clagd, the edge port setting on the peer link changes. |
3.7.2-4.2.0 | 4.2.1-4.4.5 |
| 2551651 |
The net show dot1x interface summary command output shows a MAC address with all zeros associated with a port. |
3.7.12-4.2.0 | 4.2.1-4.4.5 |
| 2551578 |
When you configure a bridge in the /etc/network/interfaces file, then try to reconfigure the bridge to be a VRF interface with the same name, ifreload/ifup commands fail with an invalid table id or unable to get vrf table id error. |
3.7.12-3.7.16, 4.0.0-4.4.5 | |
| 2551543 |
switchd might crash if more than 16 IPv6 default route next hops are installed in the kernel routing table and those 16 next hops recurse to MAC address table entries reachable over VXLAN VNI interfaces. This can occur when many IPv6 router advertisements (RAs) are received across VLAN interfaces that have IPv6 forwarding disabled.To work around this issue, add the following parameters to the /etc/sysctl.conf file to disable IPv6 default route installation from received router advertisements, then run the sudo sysctl -p –system command.
|
3.7.12 | 3.7.13-3.7.16 |
| 2551305 |
The net show configuration command provides the wrong net add command for ACL under the VLAN interface. |
3.7.12-3.7.16, 4.1.0-4.4.5 | |
| 2551288 |
When you remove BFD configuration by editing the /etc/frr/frr.conf file and restarting FRR, you see a traceback.To work around this issue, either use NCLU or vtysh commands to remove the BFD configuration, or restart FRR with the new /etc/frr/frr.conf file. |
3.7.7-3.7.16 | 4.0.0-4.4.5 |
| 2551161 |
switchd memory utilization might continue to increase if there are excessive and continuous link flaps over a long period of time.To work around this issue, correct the cause of the frequent link flaps. You can restart switchd with the sudo systemctl restart switchd command to recover memory; this operation is impactful to all traffic on the switch during the restart. |
3.7.11-3.7.12, 4.0.0-4.2.0 | 3.7.13-3.7.16, 4.2.1-4.4.5 |
| 2550974 |
On the Dell S3000 switch, after installing the Cumulus Linux 4.1.1 disk image without a license, the switch sends a link beat if a remote host port is configured. | 3.7.11-3.7.16, 4.1.1-4.4.5 | |
| 2550942 |
NCLU tab completion for net show displays the text add help text instead of system Information for the system option. |
3.7.11-4.2.0 | 4.2.1-4.4.5 |
| 2550796 |
On a Broadcom switch with the Trident2+ ASIC, ACL rules for VLANs are not applied after a reboot and the counters remain at zero. To work around this issue, either do not set acl.non_atomic_update_mode = TRUE in the /etc/cumulus/switchd.conf file or run the cl-acltool -i command after the reboot to install the ACLs. |
3.7.12-4.2.1 | 4.3.0-4.4.5 |
| 2550793 |
The NCLU net show bridge spanning-tree command displays the aging timer incorrectly. |
3.7.12-3.7.16, 4.0.0-4.4.5 | |
| 2550600 |
The received PVST BPDU for a VLAN is flooded even though the ingress port doesn’t have the VLAN tagged. | 3.7.8-3.7.14.2, 4.0.0-4.3.0 | 3.7.15-3.7.16, 4.3.1-4.4.5, 4.4.0-4.4.5 |
| 2550478 |
VXLAN interface as in-interface or out-interface in an ACL is not supported in Spectrum-based switches. | 3.7.7-4.2.0 | 4.2.1-4.4.5, 4.3.0-4.4.5 |
| 2550444 |
Tab completion for the net show rollback description command returns information about a snapshot instead of context help.To work around this issue, run the net show commit history command to find descriptions instead of the net show rollback description command. |
3.7.12-3.7.16, 4.0.0-4.4.5 | |
| 2550443 |
The net show rollback description command returns an error even if the string matches a commit description.To work around this issue, look for your string in the output of the net show commit history command (or grep for it there) instead. |
3.7.12-3.7.16, 4.0.0-4.4.5 | |
| 2550375 |
CPU utilization may increase when clag-managed bond interfaces are operationally/LACP down but the physical carrier remains up on the bond member switchports. This condition occurs when clag bond redirection is enabled and bond members remain up while the parent bond does not negotiate LACP. This issue is resolved in Cumulus Linux 3.7.14. |
3.7.9-4.2.1 | 4.3.0-4.4.5 |
| 2550350 |
Unicast traffic from downlink hosts is flooded to multiple remote VTEPs, which might also cause high HwIfOutQDrops/TX_DRP on the uplink ports. To work around this issue, restart switchd. |
3.7.10-4.1.1 | 4.2.0-4.4.5 |
| 2550323 |
After a neighbor is removed, the redistributed neighbor entry is withdrawn from the BGP table, but the prefix might still be selected as the bestpath when the host’s originated prefix is not advertised. To work around this issue, recreate the neighbor entry and flap the interface to the host. Or, if the host is already down, manually create a neighbor entry with an invalid MAC address, which forces redistribute neighbor to re-withdraw the entry. |
3.7.3-3.7.16 | 4.0.0-4.4.5 |
| 2550276 |
In LLDP, the snmp subagent loses all subsequent lldpRemSysName (1.0.8802.1.1.2.1.4.1.1.9) entries after an entry with a missing SysName is added.All the information from lldpctl is correct. Only the entries after the entry that is missing a SysName in lldpRemSysName disappear from the snmp subagent. |
3.7.12-4.2.1 | 4.3.0-4.4.5 |
| 2550274 |
If packets with an invalid checksum are received, the cumulus-poe service might restart and you see log messages similar to the following:May 20 10:48:04.665635 leaf01 poed[8012]: ERROR : invalid checksum in response [0xC2:0x00] May 20 10:48:04.671299 leaf01 poed[8012]: poed : ERROR : invalid checksum in response [0xC2:0x00] May 20 10:48:04.708620 leaf01 systemd[1]: cumulus-poe.service: main process exited, code=exited, status=1/FAILURE The service starts automatically but there is an impact to POE devices momentarily. |
3.7.12, 4.0.0-4.1.1 | 3.7.13-3.7.16, 4.2.0-4.4.5 |
| 2550243 |
When you use nginx and restserver in management VRF to provide a REST API for the switch, nginx starts but restserver fails to start.To work around this issue, comment out the Requires= line in the /lib/systemd/system/restserver.service. For example:
|
3.7.12-3.7.16, 4.0.0-4.4.5 | |
| 2550056 |
The ACCTON-DIAG option under the Cumulus Linux GRUB menu does not work. When you select this option, you see the following error:
|
3.7.12-3.7.16, 4.1.1-4.4.5 | |
| 2549925 |
When you run an Ansible script to replace the /etc/network/interfaces file, then run the ifreload -a command, you see errors similar to the following:
To work around this issue, run the ifreload -a command a second time. |
3.7.12-3.7.16, 4.0.0-4.4.5 | |
| 2549872 |
If you have an SVI with multiple VRR IP addresses and try to delete one of the VRR configurations, net commit or ifreload -a returns an error. |
3.7.12-3.7.16, 4.1.1-4.4.5 | |
| 2549838 |
In vtysh, if you configure, then remove a layer 3 VNI for a VRF, the VNI is removed from zebra even if the VNI interface still exists in the kernel. If you configure a layer 2 VNI as a layer 3 VNI by mistake, removing the layer 3 VNI binding removes it from zebra but EVPN-learned MACs and neighbors are not installed into the kernel. To work around this issue, delete, then re-add the missing VNI. For example:
If you flap the link with the ip link set vni10100 down; ip link set vni10100 up commands, zebra does not re-add the VNI. |
3.7.12-4.2.1 | 4.3.0-4.4.5 |
| 2549794 |
The asic-monitor.service fails when you configure /etc/cumulus/datapath/monitor.conf with monitor.histogram_pg.collect.port_group_list = [all_packet_pg] and there is traffic passing through the buffer. When the service fails, you see the following traceback in journalctl:
|
3.7.11-4.2.0 | 4.2.1-4.4.5 |
| 2549782 |
The JSON format output of the net show bgp l2vpn evpn summary command shows the incorrect neighbour state. |
3.7.12-3.7.16, 4.0.0-4.4.5 | |
| 2549731 |
When you create SPAN or ERSPAN rules in ebtables, the action fails to install if it is not in lowercase. Make sure that the SPAN or ERSPAN action is all lowercase; for example:
|
3.7.12-3.7.16, 4.1.1-4.4.5 | |
| 2549676 |
After you add or remove a bridge VLAN identifier (VID) on a trunk port, the layer 2 VNI is put into VLAN 1. To work around this issue, revert the configuration change. |
3.7.10-3.7.12, 4.0.0-4.1.1 | 3.7.13-3.7.16, 4.2.0-4.4.5 |
| 2549472 |
On switches with the Trident3 ASIC, PFC is not working as expected. If you set the PFC for only one CoS, pause frames are sent for all CoS traffic. | 3.7.11-4.1.1 | 4.2.0-4.4.5 |
| 2549397 |
When the BGP Multi-protocol Unreach NLRI attribute is received in a BGP update without a next hop attribute, the BGP session is brought down unexpectedly. RFC 4760 defines that the next-hop attribute is not required for updates containing MP_UNREACH_NLRI. | 3.7.12-3.7.16 | 4.0.0-4.4.5 |
| 2549371 |
When Optimized Multicast Flooding (OMF) is enabled with the bridge.optimized_mcast_flood = TRUE setting in the /etc/cumulus/switchd.conf file, the switch continues to flood IPv6 multicast traffic to all slave ports when there is no MLD join receive. |
3.7.11-4.3.3 | 4.4.0-4.4.5 |
| 2549226 |
You might see the following gport error messages in switchd.log:
These messages are harmless and can be ignored. |
3.7.12-4.2.1 | 4.3.0-4.4.5 |
| 2548962 |
With FRR or OSPF, you might see an inconsistent link-state advertisement. For example, when you configure the OSPF default originate route as metric-type 1 with a specific metric, Cumulus Linux shows the default originate route as an external metric-type 2 route with the default metric in the database. This issue typically occurs when both IPv4 and IPv6 default routes exist in the routing table. | 3.7.12-4.1.1 | 4.2.0-4.4.5 |
| 2548930 |
On Mellanox Spectrum switches that contain an OSPF IP unnumbered neighborship with a high scale of prefixes being learned, a link flap might cause the neighbor entry to not be programmed in hardware. | 3.7.11-4.2.1 | 4.3.0-4.4.5 |
| 2548746 |
On the Broadcom switch with the Trident3 ASIC, packet priority remark values assigned from each internal CoS value continue to work with default values; if you change the internal CoS value, the change does not take effect. | 3.7.11-4.1.1 | 4.2.0-4.4.5 |
| 2548673 |
A large number of flapping peers causes FRR to require a corresponding update to internal data structures that track peer information. Updating this internal data structure does not delete links that are down due to the flapping. The size of this array then grows to contain both current peers as well as peers that should have been deleted during the flap processing. The contents of this array is processed by FRR to poll the links, which consumes CPU for all items in the array. This additional polling consumes more CPU than necessary but has no functional impact. To work around this issue, restart FRR. |
3.7.11-3.7.12, 4.0.0-4.1.1 | 3.7.13-3.7.16, 4.2.0-4.4.5 |
| 2548659 |
When a link flap occurs while IPv6 traffic traverses interfaces, a kernel panic may occur with the following logs printed to the console:
|
3.7.12 | 3.7.13-3.7.16 |
| 2548657 |
When you upgrade Cumulus Linux on the EdgeCore AS7726-32X or AS7326-56X switch, you might see firmware errors similar to the following:
You can safely ignore these error messages. |
3.7.12-3.7.16, 4.0.0-4.4.5 | |
| 2548585 |
After you flap an MLAG peerlink, a rare condition might occur where routes and neighbors for VXLAN-enabled VLANs are misprogrammed as non-VXLAN routes and neighbors due to VNI state transitions. This results in a forwarding failure for traffic destined to these misprogrammed routes and neighbors. Note: Do not flap a VNI interface manually. The only expected time for a VNI interface to go down is when the MLAG secondary switch brings the VNIs protodown during a peer link failure where the backup IP address is still active. To recover from this condition, restart switchd with the sudo systemctl restart switchd command. |
3.7.10-3.7.12, 4.1.0-4.1.1 | 3.7.13-3.7.16, 4.2.0-4.4.5 |
| 2548490 |
A change in a route map prefix list that should remove a route might not be reflected in the ospf6 database or in peers, and the route might not be deleted. To work around this issue, reenter the redistribute <connected|static> route-map statement in the configuration. |
3.7.11-4.1.1 | 4.2.0-4.4.5 |
| 2548485 |
If you configure the aggregate-address summary-only option before injecting a component of the same aggregate into the BGP table with the network or redistribute command, when you remove the aggregate-address configuration, the component stays suppressed; it is not advertised to peers. For example:Existing configuration:router bgp 1If you add network 50.0.0.1/32, you see the following (expected) BGP table entries:Status codes: s suppressed, d damped, h history, * valid, > best, = multipath,Removing aggregate-address 50.0.0.0/8 summary-only at this point results in the following (unexpected) BGP table entry:Status codes: s suppressed, d damped, h history, * valid, > best, = multipath,To work around this issue, remove, then re-add the component prefix routes. |
3.7.12-4.2.1 | 4.3.0-4.4.5 |
| 2548475 |
After you add a new VNI and a layer 3 SVI to a set of leafs, certain leafs might not be able to communicate on the layer 3 VNI. To work around this issue, reboot the leaf switch or restart switchd. |
3.7.6-3.7.16 | 4.0.0-4.4.5 |
| 2548382 |
The QuantaMesh BMS T3048-LY8 switch shows a low fan RPM in syslog. | 3.7.5-3.7.12, 4.0.0-4.1.1 | 3.7.13-3.7.16, 4.2.0-4.4.5 |
| 2548372 |
On the Edgecore AS5812 switch, the Innodisk DIMM causes a DIMM temperature sensor absent alert. | 3.7.12, 4.0.0-4.1.1 | 3.7.13-3.7.16, 4.2.0-4.4.5 |
| 2548307 |
When the garbage collector does not release memory back to the operating system, clagd might consume a large amount of memory. As a result of low system memory, systemd might shut down services to reclaim memory. |
3.7.11-3.7.12, 4.1.0-4.1.1 | 3.7.13-3.7.16, 4.2.0-4.4.5 |
| 2548243 |
On switches with the Trident2+ ASIC, adding SPAN rules disables PBR rules. | 3.7.3-3.7.16, 4.0.0-4.4.5 | |
| 2548155 |
The net show bgp neighbor swpX json command shows negative output for the bgpTimerUpMsec timer. |
3.7.10-3.7.16 | 4.0.0-4.4.5 |
| 2548117 |
In OVSDB traditional bridge mode, adding or removing a VLAN binding causes a traffic forwarding outage for around 20 seconds or more on adjacent VLAN bindings. Cumulus Linux does not support traditional bridge mode with VMware NSX. | 3.7.12-3.7.16, 4.0.0-4.4.5 | |
| 2548116 |
The OVSDB log contains duplicate MAC addresses with the well-known BFD MAC address (00:23:20:00:00:01). This is mainly cosmetic, but clutters the log. | 3.7.12-4.0.1 | 4.1.0-4.4.5 |
| 2548112 |
In OVSDB VLAN-aware mode, removing a VTEP binding on the NSX controller fails to clean up all interfaces associated with the logical switch. | 3.7.12, 4.0.0-4.1.1 | 3.7.13-3.7.16, 4.2.0-4.4.5 |
| 2548111 |
When you remove, then re-add an NSX VTEP binding, the VXLAN VTEP interface is not recreated. | 3.7.9-4.0.1 | 4.1.0-4.4.5 |
| 2548044 |
When a remote VTEP withdraws a type-3 EVPN route, Cumulus Linux purges all MAC address and neighbor entries installed in the corresponding layer 2 VNI through that remote VTEP from the local EVPN and kernel forwarding tables. This purge occurs even if the remote VTEP does not withdraw type-2 routes carrying the MAC address or neighbor entries. The entries stay missing from the local EVPN and kernel forwarding tables until BGP updates the MAC address and neighbor. | 3.7.12-3.7.15, 4.0.0-4.4.5 | 3.7.16 |
| 2548024 |
On the Dell Z9100 switch, 100G-SR4 modules might not link up reliably in certain ports. swp1, 2, 3, 9, 10, 23, 24, 30, 31, and 32 might be affected To work around this issue, move 100G SR4 modules to one of the ports not affected by this issue. |
3.7.11-4.1.1 | 4.2.0-4.4.5 |
| 2547942 |
On the Lenovo NE0152T switch, one power supply (PSU2) always show as ABSENT in smonctl. | 3.7.11-4.0.1 | 4.1.0-4.4.5 |
| 2547839 |
When you try to configure link-down on a parent interface of a subinterface configured in a VRF, you encounter an error. |
3.7.11-4.1.1 | 4.2.0-4.4.5 |
| 2547799 |
An error similar to the following shows in syslog for Mellanox switches:
To work around this issue, reboot the switch. |
3.7.11-4.0.1 | 4.1.0-4.4.5 |
| 2547784 |
PTM mis-detects incorrect hostnames of LLDP neighbors and does not fail them as expected. Instead they end up in an N/A cabling status. | 3.7.11-4.1.1 | 4.2.0-4.4.5 |
| 2547782 |
If a LLDP neighbor advertises a PortDescr that contains commas, ptmctl -d splits the string on the commas and misplaces its components in other columns. |
3.7.11-3.7.16, 4.0.0-4.4.5 | |
| 2547769 |
syslog might report a high load average with the CPU running a later microcode revision. |
3.7.4-3.7.12 | 3.7.13-3.7.16 |
| 2547706 |
When you configure ganged ports in the ports.conf file, the change does not take effect after you restart switchd. To work around this issue, reboot the switch. |
3.7.11-3.7.16, 4.0.0-4.4.5 | |
| 2547666 |
On the Dell S5232F-ON switch, the output of ledmgrd shows amber_blinking but smonctl shows all OK. |
3.7.11-3.7.12, 4.0.0-4.1.1 | 3.7.13-3.7.16, 4.2.0-4.4.5 |
| 2547663 |
When traffic from a double tag interface (facing a different site) is forwarded through VXLAN, the inner tag is not removed. The destination does not know this tag, so it discards it. | 3.7.8-4.0.1 | 4.1.0-4.4.5 |
| 2547659 |
On the EdgeCore AS7326-56X switch, the default fan speed, which is defined in the thermal specification, results in excessive fan noise. | 3.7.11-4.0.1 | 4.1.0-4.4.5 |
| 2547658 |
On the Lenovo NE0152T switch, one power supply (PSU2) always show as ABSENT in smonctl. | 3.7.11-3.7.12 | 3.7.13-3.7.16 |
| 2547609 |
Mellanox switches with the Spectrum A0 ASIC that are integrated with VMware NSX experience BFD connectivity issues with service nodes. As a result, VXLAN tunnels do not work. Mellanox switches with the Spectrum A1 ASIC do not have this issue. |
3.7.11-3.7.12, 4.0.0-4.1.1 | 3.7.13-3.7.16, 4.2.0-4.4.5 |
| 2547592 |
When you add a route map to advertise IPv4 unicast in a BGP EVPN configuration and the route map contains a set operation, BGP crashes. | 3.7.11-4.0.1 | 4.1.0-4.4.5 |
| 2547573 |
On Tomahawk switches, when the vxlan_tnl_arp_punt_disable option is set to FALSE, ARP packets are not forwarded to the CPU. |
3.7.9-3.7.16 | |
| 2547443 |
On the Dell N3248PXE-ON switch, 25G SFP ports do not work in 10G mode. | 3.7.11-4.0.1 | 4.1.0-4.4.5 |
| 2547381 |
The hsflowd service sends an undefined header protocol 0 in the sampled flow sample to the collector, which is not recognized by the sFlow tool. You see errors similar to the following:
|
3.7.11-3.7.16 | 4.0.0-4.4.5 |
| 2547349 |
When you change an interface IP address, then change it back, static routes are misprogrammed One of the following actions recovers the routes:- Bounce both layer 3 interfaces- Remove or add static routes in FRR- Restart FRR |
3.7.11-3.7.16 | 4.0.0-4.4.5 |
| 2547293 |
On the Broadcom Trident3 switch with DHCP relay, where the DHCP server is reachable through the EVPN overlay, DHCP discover packets forwarded to the CPU might appear corrupt and might not get forwarded. | 3.7.9-4.0.1 | 4.1.0-4.4.5 |
| 2547246 |
The MLAG switch pair has VLANs defined that are not used on MLAG bonds. These VLANs still synchronize MAC addresses across to the peer switch. This results in log messages that indicate a MAC address is installed and the VLAN is not defined; for example:
|
3.7.10-4.1.1 | 4.2.0-4.4.5 |
| 2547147 |
The ospfd daemon might crash with the following kernel trace:
|
3.7.11-4.0.1 | 4.1.0-4.4.5 |
| 2547123 |
On the Broadcom switch with the Trident3 ASC, packet priority remark values assigned from each internal CoS value continue to work with default values; if you change the internal CoS value, the change does not take effect. | 3.7.11-4.1.1 | 4.2.0-4.4.5 |
| 2547120 |
After you hot swap a PSU, the decode-syseeprom -t psuX command shows the old PSU information (such as the serial number), until you run the decode-syseeprom –init command. |
3.7.11-3.7.16, 4.0.0-4.4.5 | |
| 2547100 |
On switches with the Trident3 ASIC, PFC is not working as expected. If you set the PFC for only one CoS, pause frames are sent for all CoS traffic. | 3.7.11-4.1.1 | 4.2.0-4.4.5 |
| 2547068 |
Hardware platforms using the Intel D-1500 CPU series might reboot unexpectedly To work around this issue, contact your hardware vendor to inquire if a new version of BIOS with a microcode fix is available or manually disable CPU C-states in the kernel as outlined below To permanently disable C-states using a kernel boot parameter:1. Edit /etc/default/grub to add the argument processor.max_cstate=0 to the variable GRUB_CMDLINE_LINUX. For example, if /etc/default/grub file contains the line GRUB_CMDLINE_LINUX=“cl_platform=accton_as7726_32x console=tty0 console=ttyS0,115200n8 intel_iommu=off pcie_aspm=off”, change it to GRUB_CMDLINE_LINUX=“cl_platform=accton_as7726_32x console=tty0 console=ttyS0,115200n8 intel_iommu=off pcie_aspm=off processor.max_cstate=0”2. Run sudo update-grub3. Reboot the system with sudo rebootTo disable cstates in realtime on the current system, which does not persist through a reboot:1. Confirm that the libpci3 package is installed. Run dpkg-query -l libpci3 and confirm the following line is displayed:ii libpci3:amd64 1:3.2.1-3 amd64 Linux PCI Utilities (shared library)The first field above should read ii. If not, install the libpci3 package by running sudo apt upgrade;sudo apt install libpci32. Disable C-states by running the command ./cpupower idle-set -d 2C-states are disabled by default in Cumulus Linux 4.3.0 and later. |
3.7.9-4.2.1 | 4.3.0-4.4.5 |
| 2546991 |
The FRR service does not provide a way for automation to know if the configuration applied properly. To work around this issue, execute the vtysh -f command in the automation file before starting the FRR service to validate the functional configuration and return an error code. |
3.7.11-3.7.16, 4.0.0-4.4.5 | |
| 2546984 |
On the EdgeCore AS7326-56X switch, the PSU fans show constant LOW warnings. | 3.7.10-3.7.12, 4.0.0-4.2.0 | 3.7.13-3.7.16, 4.2.1-4.4.5 |
| 2546950 |
switchd crashes when dynamic VRF route leaking is enabled and the following is true:* The default route is leaked from VRF1 to VRF2 * Hardware-based dynamic VRF route leaking is configured ( vrf_route_leak_enable_dynamic is set to TRUE in the /etc/cumulus/switchd.conf file). You might see logs similar to the following in /var/log/syslog:
To work around this issue, use a route map to filter the default route (the source VRF is imported into the destination VRF). |
3.7.10-3.7.12, 4.0.0-4.1.1 | 3.7.13-3.7.16, 4.2.0-4.4.5 |
| 2546895 |
If you have configured a higher number of ports and VLANs (ports x VLANs) or the switch is a lower-powered (CPU) platform, the switchd service might fail to send a systemd keepalive within the watchdog timeout value (2 minutes by default) and you see an error similar to the following:bq. systemd[1]: switchd.service watchdog timeout (limit 2min)!To workaround this issue, either reduce the number of configured interfaces and, or VLANs, or increase the systemd timeout for switchd.serviceTo increase the systemd timeout:1.Edit the /etc/systemd/system/switchd.service.d/override.conf file and increase the WatchdogSec parameter2.Restart the switchd service with the sudo systemctl restart switchd.service commandsystemd attempts to restart the switchd service automatically (after the watchdog timeout). If the restart fails multiple times in a short time period, run the sudo systemctl reset-failed command followed by the sudo systemctl restart switchd command. |
3.7.11-3.7.16, 4.0.0-4.4.5 | |
| 2546577 |
A traditional bridge with QinQ and a VNI does not work for tagged traffic. | 3.7.10-4.0.1 | 4.1.0-4.4.5 |
| 2546450 |
On the EdgeCore AS7326-56X switch, you might see the RPM of certain fans run over the maximum threshold. | 3.7.11-3.7.16 | |
| 2546385 |
SNMP ifLastChange reports link transitions when there are none. | 3.7.6-3.7.16 | |
| 2546225 |
When you execute the following command on the Delta AG6248C switch, the switch reboots and then comes right back into Cumulus Linux without installing the new image. The install image is still in /var/lib/cumulus/installer, which causes issues with cl-support.
To work around this issue, use the onie-select command to access ONIE, and then use the nos-install command in ONIE to install a new binary image. |
3.7.11-3.7.16, 4.0.0-4.4.5 | |
| 2546203 |
When using QinQ with a traditional bridge, if you enable the LLDP dot1 TLV option, you see the following suboptimal behavior: * Both the inner and outer VLAN information is sent as part of VLAN TLVs in the LLDP packet. * If the outer VLAN ID is the same as the inner VLAN ID, only one VLAN TLV is sent with that VLAN ID in the LLDP packet. |
3.7.11-3.7.16 | |
| 2546141 |
CPU usage might be higher than normal if you have a high number of interfaces x VLANs and lldpd is active. This issue is introduced with code changes in Cumulus Linux 3.7.11, where VLAN information is now available for LLDP to advertise to neighbors ([https://docs.cumulusnetworks.com/version/cumulus-linux-37/Layer-2/Link-Layer-Discovery-Protocol/#vlan-dot1-tlv]). You might see high CPU usage even if VLAN (dot1) TLV configuration is disabled. To check if lldpd is the heavy CPU resource user, run the following command:
Alternatively, check for messages in the /var/log/syslog directory similar to:
Note: The exact amount of CPU usage varies in each network based on a number of factors; however, it is unusual for lldpd to consume more than 30% CPU for an extended period of time.To work around this issue, you can do one of the following: * If the large number of VLANs is not absolutely necessary, manually prune the VLAN allowed list (if you use the range 1-2999, modify the bridge-vids list to include the VLANs being used).* Stop the lldpd service. (This approach might be undesirable if the switch is providing services that rely on LLDP such as Voice VLAN.) To stop the lldpd service (runtime setting), run the sudo systemctl stop lldpd.service command. To disable the lldpd service upon boot, run sudo systemctl disable lldpd.service. |
3.7.11-4.0.1 | 4.1.0-4.4.5 |
| 2546131 |
On the Delta AG-6248C PoE switch, when you run the apt upgrade command, the upgrade does not work. Cumulus Linux uses uboot directly instead of grub to boot the kernel. Uboot needs a special header to boot the kernel, which is not present. Without this header, when you use the apt upgrade command to upgrade Linux packages, uboot is unable to boot up the kernel. To work around this issue, upgrade Cumulus Linux by installing the Cumulus Linux image. Run the onie-select command to go into ONIE, and then use the nos-install command in ONIE to install a new image.This workaround only works when an out-of-band network is present. |
3.7.11-3.7.16, 4.0.0-4.4.5 | |
| 2546010 |
When hal.bcm.per_vlan_router_mac_lookup is set to TRUE in the /etc/cumulus/switchd.conf file, inter-VLAN traffic is forwarded to the CPU when associated VNI interfaces exist. |
3.7.10-3.7.16 | |
| 2545997 |
The NCLU command net show interface produces an error if bonds with no members exist.To work around this issue, remove the empty Bond interfaces from the /etc/network/interfaces file and run sudo ifreload -a. |
3.7.10-3.7.16 | |
| 2545699 |
On the Celestica Pebble switch, if you use IPv6 routes with mask /65 to /127, the switchd log fills with errors. |
3.7.10-4.0.1 | 4.1.0-4.4.5 |
| 2545566 |
The Dell Z9100-ON switch incorrectly reports many sensors as ABSENT. | 3.7.12-4.0.1 | 4.1.0-4.4.5 |
| 2545446 |
If you use NCLU commands to add a non-MLAG bond, then add an MLAG configuration, the net commit command fails. However, a subsequent net commit command succeeds. |
3.7.10-3.7.16 | |
| 2545404 |
On the Trident3 switch, unicast ARP packets received on a VNI and forwarded to the CPU are not policed. | 3.7.10-4.0.1 | 4.1.0-4.4.5 |
| 2545125 |
If you configure more than one VRR interface on an SVI interface, deleting one of the VRR addresses does not remove the interface/address. | 3.7.10-3.7.16, 4.0.0-4.4.5 | |
| 2544978 |
If you delete an undefined bond, then add a bond slave, the net commit command fails. |
3.7.9-3.7.16, 4.0.0-4.4.5 | |
| 2544968 |
FRR configuration commands for an SVI interface might have the \n misplaced in the output. For example:
should be:
To work around this issue, configure the interface manually in the /etc/frr/frr.conf file. |
3.7.9-3.7.16, 4.0.0-4.4.5 | |
| 2544953 |
When you update the hostname of a switch with the NCLU net add hostname command, then run net commit, the lldpd service does not restart and other devices still see the old hostname.To work around this issue, run the sudo systemctl restart lldpd.service command. |
3.7.10-3.7.16, 4.0.0-4.4.5 | |
| 2544904 |
After you delete an IPv6 numbered BGP peer group neighbor, Cumulus Linux might continue to send route advertisements. To work around this issue, restart FRR after removing the IPv6 numbered configuration. |
3.7.9-4.1.1 | 4.2.0-4.4.5 |
| 2544829 |
Frames received with a VLAN tag of 0 on an interface configured as a bridge port and forwarded to the CPU for processing might appear tagged with the native VLAN when viewed with tcpdump. |
3.7.8-3.7.16 | |
| 2544556 |
If you reconfigure an NTP server with NCLU using different trailing options after the IP address (such as iburst), an invalid configuration is added to the /etc/ntp.conf file. For example:
If you need to alter existing server configurations, first remove the server, commit, then re-add the server with any trailing options. |
3.7.9-4.1.1 | 4.2.0-4.4.5 |
| 2544463 |
Auto-negotiation does not work with the QSFP28 cables and a remote system operating at 10G. Attempting to enable auto-negotiation with ethtool -s swp<#> autoneg on returns Operation not supported.To work around this issue, do not use auto-negotiation and set the local port speed to 10G. |
3.7.9-3.7.16, 4.0.0-4.4.5 | |
| 2544456 |
The NCLU net show lldp command displays the speed of a ganged port group as the speed of one of the individual links, rather than the sum of their speeds. |
3.7.9-3.7.16, 4.0.0-4.4.5 | |
| 2544311 |
Applying a policy-based routing (PBR) rule for all traffic from a host might disrupt ARP refresh for that connected host. | 3.7.5-3.7.16, 4.0.0-4.4.5 | |
| 2544155 |
NCLU requires you to specify an interface with multiple address-virtual statements in ascending MAC address order. |
3.7.5-3.7.16, 4.0.0-4.4.5 | |
| 2544113 |
Mac learning is not disabled by default on a double tagged peer link interface resulting in the MAC address changing between the MLAG bond and the peer link. To work around this issue, disable MAC learning on QinQ VLANs by adding bridge-learning off to the VLAN stanza in the etc/network/interfaces file. |
3.7.9-3.7.16, 4.0.0-4.4.5 | |
| 2543900 |
On the Mellanox switch, static VXLAN tunnels incorrectly allow traffic from any remote tunnel IP address. | 3.7.8-3.7.16, 4.0.0-4.4.5 | |
| 2543841 |
The net show evpn vni detail json command includes an extra empty dictionary at the end of the output. |
3.7.8-3.7.16, 4.0.0-4.4.5 | |
| 2543840 |
On the Mellanox SN2700 switch, you cannot enable resilient hashing (RASH) and set the bucket size to 64 in the traffic.conf file. |
3.7.6-3.7.16 | |
| 2543800 |
When local-tunnelip is an SVI, the static VXLAN tunnel does not work; the next hop router receives the packet but drops it as it does not know where to forward the packet. The static VXLAN tunnel does works if local-tunnelip is a loopback or a physical layer 3 interface. |
3.7.8-3.7.16 | 4.0.0-4.4.5 |
| 2543792 |
On the EdgeCore AS5712, AS6712, AS5812 and AS6812 switch, support for multiple PSU types results in log messages similar to the following:
|
3.7.9-4.0.1 | 4.1.0-4.4.5 |
| 2543648 |
You cannot specify a source and destination MAC address in an ERSPAN ebtables rule. For example, the following rule does not work:
|
3.7.6-3.7.12, 4.0.0-4.1.1 | 3.7.13-3.7.16, 4.2.0-4.4.5 |
| 2543647 |
ERSPAN in ebtables does not work for VNIs. For example, the following rule does not work:
|
3.7.6-4.2.1 | 4.3.0-4.4.5 |
| 2543646 |
In an ebtables rule, ERSPAN (upper case) does not work. You need to specify erspan (lower case). | 3.7.6-3.7.16, 4.0.0-4.4.5 | |
| 2543627 |
Tomahawk 40G DACs cannot disable auto-negotiation. | 3.7.7-3.7.16 | 4.0.0-4.4.5 |
| 2543472 |
On switches with the Spectrum ASIC, the underlay hashes VXLAN packets for a given overlay flow randomly. To work around this issue, configure the ECMP hash seed to the same value on the EVPN egress leaf switches. |
3.7.7-4.0.1 | 4.1.0-4.4.5 |
| 2543270 |
The default route injected through OSPF when you configure default-information originate always is unreliable and might age out unexpectedly.To work around this issue, rely on a different source of default route other than injection with default-information originate. |
3.7.8-4.1.1 | 4.2.0-4.4.5 |
| 2543211 |
In some cases, the switchd service might warn of excessive MAC moves from one switch port to itself (for example, from swp18 to swp18). |
3.7.0-3.7.16, 4.0.0-4.4.5 | |
| 2543164 |
The MTU of an SVI cannot be higher than the MTU on the bridge. Changing the MTU on the SVI with NCLU does not update the bridge MTU. The net commit command succeeds even though the MTU is not changed as expected.To work around this issue, change the MTU on all SVIs and the bridge manually in the /etc/network/interfaces file, then apply the change with the ifreload -a command. |
3.7.7-3.7.16, 4.0.0-4.4.5 | |
| 2543096 |
When an SVI with a virtual MAC is configured with a layer 2 VNI in an EVPN environment, if you replace the /etc/network/interfaces file with a different file that does not have the SVI and layer 2 VNI configuration, the original virtual MAC is not populated through the EVPN route until FRR is restarted. |
3.7.6-3.7.16, 4.0.0-4.4.5 | |
| 2543058 |
The IP neighbor entry for a link-local next hop is not installed by FRR, which results in a forwarding failure for routes via that next hop. This is a rare problem that occurs with IPv4 route exchange over IPv6 GUA peering with no IPv4 addresses on the interfaces. To work around this issue, flap the peering to the peer router (which might be a route reflector) to recover. To avoid this issue, configure IPv6 router advertisements on the connecting interfaces. |
3.7.7-3.7.16 | 4.0.0-4.4.5 |
| 2543052 |
Received EVPN type-5 and type-2 MACIP routes are not installed in the kernel (and hardware) routing tables for the associated VRF, which causes traffic to be blackholed. The failure to install the default route causes complete reachability failure for the particular tenant on the affected racks. The routes that are not installed are seen as “inactive” in the routing subsystem (FRR) VRF routing table. This problem is rare and can occur only in EVPN configurations that have user-configured route targets (RTs) for tenant VRFs, and only following a restart of FRR. To work around this issue, either restart the FRR service on the affected switch with the sudo systemctl restart frr.service command or bounce the layer 3 SVI for the affected VRF; for example:
You can run the net show vrf vni command to print a mapping of VRF : L3-VNI : L3-SVI. |
3.7.5-3.7.16 | 4.0.0-4.4.5 |
| 2543044 |
Under certain conditions, EVPN next hops might not be removed when the contributing peer goes down or might not be populated when the BGP session to the contributing peer comes up. You can prevent EVPN next hops from not being removed when the contributing peer goes down by specifying static MAC addresses on all layer 3 VNIs. There is no workaround for preventing EVPN next hops from not being populated when the BGP session to the contributing peer comes up. |
3.7.2-3.7.16 | 4.0.0-4.4.5 |
| 2542979 |
On the Dell-N3048EP-ON switch, when you run the sudo -E apt upgrade command, the upgrade does not work. |
3.7.7-4.1.1 | 4.2.0-4.4.5 |
| 2542945 |
On the Broadcom Maverick switch with a QinQ configuration, the packets coming into the CPU might be tagged incorrectly; for example, 802.1ad + 802.1q tags are expected in the packets but the packets have 802.1q + 802.1q tags. To work around this issue, configure the bridge with bridge-vlan-protocol 802.1ad:
|
3.7.6-3.7.16, 4.0.0-4.4.5 | |
| 2542767 |
If the BMC operating system fails to respond to IPMI, you see a traceback in bmcd and all the sensors might report ABSENT devices in smonctl. To work around this issue, power cycle the switch. |
3.7.6-4.0.1 | 4.1.0-4.4.5 |
| 2542310 |
hsflow disregards the setting for agent.cidr in the /etc/hsflowd.conf file and selects an IPv6 agent address. The source IP address of the hsflowd packet is IPv4, but the agent address in the hsflow payload shows IPv6. |
3.7.6-3.7.16 | |
| 2542305 |
If an SVI exists in the configuration before you assign it an IP address, when you do assign the IP address with the NCLU command, the vlan-id and the raw-device bridge stanzas are not added automatically. |
3.7.6-3.7.16, 4.0.0-4.4.5 | |
| 2542301 |
When first creating a bond and enslaving an interface, NCLU hides some of the bridge command suggestions, although they are still accepted. |
3.7.3-3.7.16, 4.0.0-4.4.5 | |
| 2541212 |
The maximum-prefix configuration under the IPv4 address family has an optional restart value, which you can configure. This configuration is ignored and, instead of restarting the sessions every x minutes, the peer constantly changes between established and idle due to the prefix count being exceeded. |
3.7.5-3.7.16, 4.0.0-4.4.5 | |
| 2541165 |
On the Dell N3048EP-ON switch, UPOE is supported only on ports 1 thru 12. (UPOE uses all four pairs of standard Ethernet cabling whereas PoE delivers power over two twisted pairs.) When you plug a UPOE device in a port higher than port 12, poectl reports that four_pair_mode_enabled is true. However, this configuration is not supported on the port so poectl should report that four_pair_mode_enabled is false. |
3.7.6-3.7.16 | |
| 2541029 |
On switches with the Trident2 ASIC, 802.1Q-encapsulated control plane traffic received on an interface with 802.1AD configured subinterfaces might be dropped. This issue only affects QinQ configurations. |
3.7.5-3.7.16, 4.0.0-4.4.5 | |
| 2540950 |
On the QuantaMesh T4048-IX8 or EdgeCore AS7326-56X switch, when using a 1000BASE-T SFP module, the module LEDs do not light to reflect link status. |
3.7.3-4.1.1 | 4.2.0-4.4.5 |
| 2540885 |
The Dell N3048EP-ON switch does not support 1G Base-T modules in the SFP ports. | 3.7.7-3.7.16 | |
| 2540863 |
On the EdgeCore AS5812-54X switch, the PSU2 Fan1 fluctuates between OK and LOW. When the fan speed is reported as LOW, the RPM is shown as a negative number. |
3.7.3-3.7.16 | |
| 2540753 |
If the interface alias contains a single or double quotation mark, or an apostrophe, the net show configuration commands fail with the following error:
|
3.7.5-3.7.16, 4.0.0-4.4.5 | |
| 2540444 |
SNMP incorrectly requires engine ID specification. |
3.7.4-3.7.16, 4.0.0-4.4.5 | |
| 2540352 |
When you use NCLU to configure a route map, the parser allows for glob matching of interfaces for a match interface condition when there can only be a single interface matched. The proper syntax is to use multiple route map clauses, each matching a single interface, instead of a single clause matching multiple interfaces. For example, this command is incorrect:
These commands are correct:
|
3.7.2-3.7.16, 4.0.0-4.4.5 | |
| 2540340 |
NCLU allows for the configuration of addresses on VRF interfaces, but tab completion for the net add vrf command just displays
Tab completion for the net add vrf command works correctly. |
3.7.4-3.7.16, 4.0.0-4.4.5 | |
| 2540274 |
On the Maverick switch, CPU forwarded packets might be dropped when there is no route to a leaked host route. | 3.7.5-3.7.16, 4.0.0-4.4.5 | |
| 2540204 |
When links come up after FRR is started, VRF connected routes do not get redistributed. | 3.7.4-3.7.16, 4.0.0-4.4.5 | |
| 2540192 |
The net del bridge bridge mcsnoop yes command does not return the value to the default of disabled. To work around this issue, use the net add bridge bridge mcsnoop no command to delete the mcsnoop attribute and return to the default value. |
3.7.4-3.7.16, 4.0.0-4.4.5 | |
| 2540155 |
On the Broadcom switch, when moving configuration from bridged to routed (or toggling from routed to bridged to routed), some traffic is not seen by the kernel. This can cause BGP to not establish on a transit node. |
3.7.3-3.7.16, 4.0.0-4.4.5 | |
| 2540042 |
When you try to configure the VRRP priority and advertisement-interval with NCLU on a traditional mode bridge, the net commit command fails. To work around this issue, use the vtysh command (inside FRR) to change the VRRP priority or advertisement-interval on traditional bridges. For example:
|
3.7.4-3.7.16, 4.0.0-4.4.5 | |
| 2540041 |
On SVIs in a VLAN-aware bridge, you cannot change the VRRP priority with NCLU. To work around this issue, run the vtysh command inside FRR to change the default priority. For example:
|
3.7.4-3.7.16, 4.0.0-4.4.5 | |
| 2540040 |
Cumulus Linux uses VRRPv3 as the default version, and enables both preempt and accept mode by default. You cannot change these default values with NCLU. To work around this issue, run the vtysh commands (inside FRR) to change the default values. For example:
|
3.7.4-3.7.16, 4.0.0-4.4.5 | |
| 2540031 |
NCLU does not honor auto all in the /etc/network/interfaces file and removes the existing configuration if no individual auto lines exist. |
3.7.3-3.7.16, 4.0.0-4.4.5 | |
| 2539994 |
When you try to remove a BGP peer group configuration with NCLU, the command fails but no warning message is shown. For example:
|
3.7.2-3.7.16, 4.0.0-4.4.5 | |
| 2539962 |
When an LDAP user that does not have NCLU privileges (either in the netshow or netedit group, or in the /etc/netd.conf file) runs an NCLU command, a traceback occurs instead of a permissions error. |
3.7.0-3.7.16, 4.0.0-4.4.5 | |
| 2539670 |
On the Edgecore 4610-54P switch, automatic medium-dependent interface crossover (auto-MDIX) stops working on a 100M full duplex interface and does not detect the required cable connection type. |
3.7.2-3.7.16, 4.0.0-4.4.5 | |
| 2539124 |
The net add interface command adds no ptm-enable for that interface in the frr.conf file. Running the net add or the net del command does not remove no ptm-enable from the frr.conf file. You have to remove it manually using vtysh. |
3.7.2-3.7.16, 4.0.0-4.4.5 | |
| 2539081 |
When you delete post-up and pre-down IP peer entries from the etc/network/interfaces file, then run the ifreload command, the IP addresses are not removed and the route remains in the route table. To work around this issue, either delete the IP addresses without the /32 mask component or flush the IP addresses for the interface with the ip addr flush dev command. |
3.7.0-3.7.16 | 4.0.0-4.4.5 |
| 2538875 |
IPv6 multicast traffic destined to an unregistered multicast group is flooded to all ports in a bridge despite the bridge.optimized_mcast_flood = TRUE setting in the /etc/cumulus/swichd.conf file. |
3.7.2-3.7.16 | |
| 2538790 |
NCLU automatically adds the VLAN ID (for the layer 3 VNI/SVI) to the bridge when you run net add vxlan . This configuration breaks network connectivity in an EVPN symmetric routing configuration using MLAG. To restore connectivity, remove the VLAN ID from the bridge. |
3.7.2-3.7.16, 4.0.0-4.4.5 | |
| 2538590 |
When you configure a control plane ACL to define permit and deny rules destined to the local switch, NCLU programs the control plane ACL rules into the FORWARD chain. |
3.7.2-3.7.16, 4.0.0-4.4.5 | |
| 2538562 |
On an RMP/1G-T switch, when you remove link-speed 100 with the NCLU command or by editing the etc/network/interfaces file to revert the 100M interface to the default (1G auto), the interface fails to recover and does not come back up.After you remove the link-speed, ethtool shows the advertised link modes as not reported and Speed/Duplex as unknown.To work around this issue and bring the interface back up, either restart switchd or use ethtool to configure the speed, advertised, duplex or MDI-X settings. Note: The advertised link mode gets set incorrectly if you include 1000baseT/Half. The port will come up successfully at 1G. |
3.7.2-3.7.16, 4.0.0-4.4.5 | |
| 2538302 |
portwd allows an error to change the module type based on the error. For example, a bad write to a module might cause the module type to flap, which causes the link itself to flap. |
3.7.0-3.7.16 | |
| 2538294 |
If you use NCLU to create an iBGP peering across the peer link, running the net add bgp l2vpn evpn neighbor peerlink.4094 activate command creates a new eBGP neighborship when one has already been configured for iBGP. This is unexpected; the existing iBGP configuration is valid. |
3.7.0-3.7.16, 4.0.0-4.4.5 | |
| 2538256 |
On the Broadcom switch, when a link-local multicast frame is received on an access port with a VNI in the bridge, two copies of the packet are sent across the VNI to remote VTEPs and the receiving hosts observe duplicate packets. |
3.7.2-4.0.1 | 4.1.0-4.4.5 |
| 2537819 |
When you enable FEC (RS or BaseR) on an interface, removing the configuration from that interface does not revert the FEC status to off/none. |
3.7.2-3.7.16 | 4.0.0-4.4.5 |
| 2537699 |
There is a limitation on the number of SVI interfaces you can specify as DHCP relay interfaces in the /etc/default/isc-dhcp-relay file. For example, 1500 SVI interfaces causes the dhcrelay service to exit without a core file and logs similar to the following are generated for the interfaces:
Eventually the dhcrelay service stops. |
3.7.1-3.7.16, 4.0.0-4.4.5 | |
| 2537544 |
When you run the mstpctl command, you might see the bridge-port state as blocking when it is actually disabled. You might see the same incorrect bridge-port state when other programs or tools use the output of mstpctl; for example, SNMP output from the BRIDGE-MIB. |
3.7.1-3.7.16, 4.0.0-4.4.5 | |
| 2537378 |
NCLU SNMPv3 user configuration (add, delete, modify) does not complete. Changes are made to the /etc/snmp/snmpd.conf file but the SNMPv3 user cache file /var/lib/snmp/snmpd.conf fails to update correctly and the configuration does not reflect in operation. To work around this issue, stop snmpd, remove the cache file, then restart snmpd. |
3.7.1-3.7.16 | |
| 2537188 |
When an event in the network, such as a switchd or networking service restart, leads to an OVSDB server high availability transition, an ovs-vtepd core might occur. This core generation has no effect on the functionality of high availability when the active OVSDB server is back in the network. |
3.7.2-3.7.16 | |
| 2537104 |
When you try to stop hsflowd on the Trident II+ switch with the systemctl stop hsflowd command, the process hangs until you stop it with SIGKILL. |
3.7.1-3.7.16 | 4.0.0-4.4.5 |
| 2537061 |
The Dell S5048F-ON switch (with reverse airflow, rear to front), shows the Temp-3 sensor as absent. |
3.7.1-4.0.1 | 4.1.0-4.4.5 |
| 2536608 |
Single tagged ARP requests received on a QinQ-over-VXLAN access port are dropped if ARP suppression is enabled on an unrelated VNI. |
3.7.0-3.7.16 | |
| 2536384 |
The BFD packet redirection logic used by OVSDB server high availability mode redirects BUM packets across the peer link. The iptables rule for redirection does differentiate between BFD and non-BFD VXLAN inner packets because the service node sends all frames with its own IP address as the tunnel source IP address. The VXLAN encapsulated BUM packets do not get forwarded to the CPU and do not go through the iptable redirection rule; only VXLAN encapsulated BFD packets get forwarded to the CPU due to the inner MAC DA lookup in hardware. |
3.7.0-3.7.16, 4.0.0-4.4.5 | |
| 2536179 |
On switches with the Trident 2+ ASIC, counters associated with VLANs and VRFs are not working. | 3.7.0-3.7.16, 4.0.0-4.4.5 | |
| 2535986 |
At a high CPU transmit traffic rate (for example, if there is unexpected CPU generated flooding or replication in software), when the ASIC packet driver cannot keep up with the transmit rate because there are no free DMA buffers, it can back pressure by suspending the switch port transmit queues. This can fill up the application socket buffers resulting in No buffer space available error messages on protocol sockets.When the driver recovers, it automatically resumes the transmit queues. In most cases these error messages are transient. In rare cases, the hardware queues might get stuck, which you can recover with a switchd restart. |
3.7.0-3.7.16, 4.0.0-4.4.5 | |
| 2535965 |
On the Trident3 switch, static PIM with IIF based on a layer 2 bridge does not work reliably. PIM Join via signaling is required for IPMC to work properly. To work around this issue, use dynamic signaling (joins) to manage IP multicast traffic. |
3.7.0-3.7.16, 4.0.0-4.4.5 | |
| 2533691 |
If you configure a VLAN under a VLAN-aware bridge and create a subinterface of the same VLAN on one of the bridge ports, the bridge and interface compete for the same VLAN and if the interface is flapped, it stops working. Correcting the configuration and running the ifreload command does not resolve the conflict. To work around this issue, correct the bridge VIDs and restart switchd or delete the subinterface. |
3.7.12-3.7.16, 4.0.0-4.4.5 | |
| 2532017 |
In FRR, bgp_snmp does not show all BGP peers when peer groups used. |
3.7.11-4.0.1 | 4.1.0-4.4.5 |
Fixed Issues in 3.7.12
| Issue ID | Description | Affects |
|---|---|---|
| 2547557 |
On the EdgeCore Wedge100 and Facebook Wedge-100S switch, certain physical ports are not correctly mapped to the logical ones. For example: Logical swp39 controls physical swp41 Logical swp40 controls physical swp42 Logical swp43 controls physical swp45 Logical swp44 controls physical swp46 This might causes incorrect forwarding behavior. |
3.7.11, 4.0.0-4.0.1 |
| 2547508 |
When a Trident3 switch receives packets containing an IP checksum value that is not compliant with RFC 1624, the TTL is decremented after a routing operation but the checksum is not recalculated. This results in the IP checksum value being invalid as the packet leaves the switch. | 3.7.10-3.7.11, 4.0.0-4.0.1 |
| 2547302 |
On the Dell Z9264F-ON switch, the CPU core temperature sensors report ABSENT. | 3.7.11, 4.0.0-4.0.1 |
| 2547148 |
The last eight ports of the EdgeCore AS4610-54P switch (swp41 through swp48) do not power UPOE access points. | 3.7.11, 4.0.0-4.0.1 |
| 2547121 |
An unhandled exception might occur after you run the sudo poectl -i command. In addition, random poed daemon restarts can occur without any unhandled exceptions but with an invalid response length error. Both issues can occur due to a SerialException.To work around this issue, power cycle the switch. A software reboot does not resolve the issue. |
3.7.10-3.7.11 |
| 2547106 |
Editing the outbound route-map of a BGP peer causes all received prefixes by that BGP peer to reset and reinstall. This might cause a brief impact to traffic for those prefixes. | 3.7.11 |
| 2547070 |
On the Lenovo NE2580 switch, the fan speeds are higher than expected within normal operating conditions. | 3.7.11, 4.0.0-4.0.1 |
| 2547042 |
After you convert a bond back to a layer 2 access port, ifupdown2 changes all SVI MTUs to 1500. To work around this issue, run ifreload -a a second time. |
3.7.11, 4.0.0-4.0.1 |
| 2547012 |
On the Mellanox Spectrum switch, switchd can sometimes fail when PBR rules are installed or removed from hardware if the rule is setting a next hop learned via a routing protocol. |
3.7.7-3.7.11, 4.0.0-4.0.1 |
| 2546998 |
When you configure Cumulus Linux with a /32 address on a switch port with a configured peer address (for example, to connect to a device using IP unnumbered), the switch sends GARPs for the peer address. | 3.7.5-3.7.11 |
| 2546868 |
Broadcom Field Alert - SID - MMU 2B Errors A few of the MMU memories on Broadcom switches are grouped together with single parity control. During SER correction when a parity error occurs on one of those groups, other memory in that group might also report a SER error. This occurs when the memory is accessed either by a packet hit or through a schan operation. This issue can cause SER errors in other memory and cause traffic mis-forwarding or a packet drop. |
3.7.0-3.7.11, 4.0.0-4.0.1 |
| 2546815 |
On the Delta AG6248C switch, the NCLU net show system sensors command shows an error:
To work around this issue, run the net show system sensors json command instead. |
3.7.11 |
| 2546702 |
The FRR cl-support module times out on switches on the ARM platform even when the switch is not under heavy load. To work around this issue, run the cl-support -M command to disable timeouts. |
3.7.0-3.7.11, 4.0.0-4.0.1 |
| 2546564 |
You might see a switchd memory leak during ECMP group expansion or consolidation. |
3.7.10-3.7.11 |
| 2546501 |
On the EdgeCore AS7326-56X switch, eth0 and swp1 use the same MAC address. | 3.7.9-3.7.11, 4.0.0-4.0.1 |
| 2546328 |
A memory leak in switchd might occur, which causes switchd to restart. |
3.7.10-3.7.11, 4.0.0-4.0.1 |
| 2546264 |
Ifupdown2 does not set up the front panel interface for the dhclient to accept the DHCP OFFER.To work around this issue, restart the networking service after ifreload -a with the systemctl restart networking command. |
3.7.10-3.7.11, 4.0.0-4.0.1 |
| 2546003 |
On the Delta AG6248C PoE switch, if the PoE priority is set to low on some ports, other ports with a higher priority might have their requests to draw power rejected instead of the lower priority ports being brought down. | 3.7.11 |
| 2545971 |
The ports.conf file on the Dell S5248F-ON switch does not show port ganging or breakout options. |
3.7.10-3.7.11 |
| 2545948 |
All Broadcom Trident3 X7 switches contain PCIE firmware, which is programmed by the vendor when the switch is manufactured. The latest version of this firmware (2.6) is incompatible with Cumulus Linux 3.7.11 and earlier, and Cumulus Linux 4.0. To work around this issue, downgrade the Broadcom ASIC firmware to an earlier version. |
3.7.11, 4.0.0-4.0.1 |
| 2545837 |
If you use the NCLU commands to configure NTP and run the net add time ntp source command before you run the net add time ntp server command, the /etc/ntp.conf file is misconfigured.To work around this issue, run the net add time ntp server command before you run the net add time ntp source command. |
3.7.10-3.7.11, 4.0.0-4.4.5 |
| 2545599 |
IPv6 table rules might affect forwarding. For example, if you create the following rule in the /etc/cumulus/acl/policy.d/03-sshd.rules file, the rule counter increments but IPv4 SSH traffic might be dropped.
|
3.7.2-3.7.11, 4.0.0-4.0.1 |
| 2545316 |
When an interface flap occurs, numbered IPv6 BGP sessions might fail to establish. To work around this issue, run the ip -6 route flush cache command to flush the IPv6 route cache. |
3.7.9-3.7.11 |
| 2544937 |
The neighmgrd service does not ignore neighbors on reserved devices (lo and management devices). This issue is not seen when management VRF is enabled. |
3.7.8-3.7.11 |
| 2544853 |
On the Dell S5248F-ON switch, CPU core temp sensors may show as ABSENT. | 4.0.0-4.0.1 |
| 2544012 |
After you remove a subinterface, the BGP session stays in a Connect state. | 3.7.8-3.7.11 |
| 2543903 |
The Dell N3048EP, N3048UP, and N3248PXE switches do not report the class correctly when the powered device (PD) requests a class that is greater than four. The actual power grant is correct; however, poectl displays the class as 4 for a PD requesting anything above that value. |
|
| 2543816 |
On the Dell S5248F-ON switch, smond might generate syslog messages indicating that the fan input RPM is lower than the normal low speed of 2500 RPM. Speeds as low as 1700 RPM are acceptable in normal thermal environments; therefore, you can ignore these messages. |
3.7.6-3.7.11, 4.0.0-4.4.5 |
| 2542823 |
On the Broadcom Trident 3 switch, VXLAN encapsulated packets are dropped on the ingress port (tagged layer 2 port) during transit forwarding (the local switch does not terminate the VXLAN tunnel). An example of where this two-layer VXLAN inside VXLAN encapsulation might occur: - VXLAN tunnel (#1) between two servers (different racks) to provide layer 2 extension for containers or VM hosts. - VXLAN tunnel (#2) between the TOR switch in rack 1 to the TOR switch located in the remote rack. To work around this issue, either: - Configure the edge port (facing the servers) to be an access port (instead of a trunk/tagged port) - Change the destination port from 4789 to something else (VXLAN tunnel terminated by the servers) |
3.7.5-3.7.11, 4.0.0-4.0.1 |
3.7.11 Release Notes
Open Issues in 3.7.11
| Issue ID | Description | Affects | Fixed |
|---|---|---|---|
| 3410952 |
If MLAG is configured but disconnected from an MLAG peer for an extended period of time (days or more), there is a long delay (up to a minute per day) before traffic forwarding stabilizes after the MLAG peer connection re-establishes. | 3.7.0-4.3.1 | 4.3.2-4.4.5, 5.5.0-5.15.0 |
| 3376798 |
On Broadcom switches, Cumulus Linux does not create the hardware bridging domain for a traditional bridge with a VXLAN interface during switchd restart. The /var/log/switchd.log file includes the following exception logs shortly after switchd restarts:switchd[30158]: hal_bcm_l3.c:1617 find_egr_path_if_vxlan_overlay:vxlan overlay : nh PORT: port <#>, vlanMAC learning looks correct, but traffic does not flow as expected. |
3.7.0-4.3.1 | 4.3.2-4.4.5 |
| 3330705 |
When using TACACS+, a TACACS+ server name that returns more than one IP address, such as an IPv6 and IPv4 address, is counted many times against the limit of seven TACACS+ servers, which might cause some of the later listed servers to be ignored as over the limit. To work around this issue, you can set the prefer_ip_version configuration option (the default value is 4) to choose between an IPv4 or IPv6 address if both are present. |
3.7.0-5.3.1 | 5.4.0-5.15.0 |
| 3327477 |
If you use su to change to a user specified through TACACS+, the user becomes the local tacacs0 thru tacacs15 user instead of the named user to run sudo commands. As a result, the named user password might not match the local tacacs0 thru tacacs15 user password. |
3.7.0-3.7.16, 4.0.0-4.4.5, 5.0.0-5.15.0 | |
| 3216921 |
RADIUS authenticated users with read-only access to NCLU commands (users in the users_with_show list) can run edit commands if a username for a non-local account is on the users_with_edit line of the /etc/netd.conf file. To work around this issue, make sure that all usernames on the users_with_edit line of the /etc/netd.conf file are configured local users for the system (real Linux users) |
3.7.0-3.7.16, 4.3.0-4.4.5 | |
| 3209699 |
RADIUS authenticated users with read-only access to NCLU commands (users in the users_with_show list) can run edit commands if a username for a non-local account is on the users_with_edit line of the /etc/netd.conf file. To work around this issue, make sure that all usernames on the users_with_edit line of the /etc/netd.conf file are configured local users for the system (real Linux users) |
3.7.0-4.3.0, 4.4.0-5.2.1 | 4.3.1, 5.3.0-5.15.0 |
| 3017190 |
When you power cycle the switch, multiple interfaces came up in a PoE disabled state To work around this issue, run the sudo poectl -a | grep disabled command to find ports with disabled POE. Run the sudo poectl -e swp1-swp48 command to enable POE on affected ports. |
3.7.10-3.7.16 | |
| 2669438 |
Editing the /etc/frr/frr.conf file to add a new sequence at the beginning of an existing large prefix list changes the subsequent sequence numbers of the next entries in the list and FRR reload might fail with the error message frr.service reload operation timed out. Stopping. To work around this issue, instead of adding the new prefix using an existing sequence number and pushing other sequences forward, use a sequence number that is free; for example, instead of of using 5 -> 10 -> 15, use 5 -> 7 -> 10. |
3.7.11-3.7.16 | |
| 2660582 |
In an MLAG configuration, the secondary MLAG switch does not use a unique address instead of the MLAG system MAC address when there is a double failure (backup IP and peer link failure) To recover restart the clagd service with sudo systemctl restart clagd.service |
3.7.8-3.7.15 | 3.7.16 |
| 2653400 |
When 802.1x MAB and a parking VLAN are configured on an interface, hostapd might install a static fdb entry if the interface is down. To work around this issue, delete 802.1x from the interface with the net del interface command, then add back the 802.1x configuration. |
3.7.10-3.7.16 | |
| 2645846 |
When 802.1x MAB and a parking VLAN are configured on an interface, hostapd might install a static fdb entry if the interface is down. To work around this issue, delete 802.1x from the interface with the net del interface command, then add back the 802.1x configuration. |
3.7.10-3.7.15 | 3.7.16, 4.3.1-4.4.5 |
| 2633245 |
On the Dell N3048EP-ON switch, the SPF+ ports remain down after a power cycle. | 3.7.10-3.7.16 | |
| 2595889 |
In a traditional bridge configuration with ip-forward off, neighbors are synchronized to hardware with a switchd restart but are cleared when you flap the bridge interface. |
3.7.10-4.2.1 | 4.3.0-4.4.5 |
| 2562511 |
hostapd does not fail over to secondary RADIUS servers for 802.1x authentication when the primary radius is reachable but not responding to Access-RequestsIf the primary RADIUS server is having a problem servicing requests, you can remove it from the configuration temporarily to force requests to be sent to alternate servers. |
3.7.10-3.7.14.2 | 3.7.15-3.7.16 |
| 2556233 |
Some ECMP next-hops might fail installation into hardware at high ECMP group and route scale. The following log message will be observed when this condition occurs:WARN xx routes reverted to non-ECMP due to NH table capacity |
3.7.9-3.7.14.2 | 3.7.15-3.7.16 |
| 2556037 |
After you add an interface to the bridge, an OSPF session flap might occur |
3.7.9-4.2.0 | 4.2.1-4.4.5 |
| 2556019 |
After you add an interface to a bridge using the NCLU net add bridge bridge ports command, the bridge can go down and its MAC address changesTo work around this issue, use Linux commands to add an interface to a bridge. |
3.7.9-3.7.13 | 3.7.14-3.7.16 |
| 2554785 |
After you reboot a Broadcom switch, switchd might fail to restart and you see logs in switchd.log similar to the following:Nov 12 12:20:05.063876 leaf01 switchd[9867]:Nov 12 12:20:05.064310 leaf01 switchd[9867]: hal_bcm_console.c:294 0:system_init:Nov 12 12:20:05.064428 leaf01 switchd[9867]: hal_bcm_console.c:294 system_init: Misc init failed: Operation timed outNov 12 12:20:05.064464 leaf01 switchd[9867]:Nov 12 12:20:05.091995 leaf01 switchd[9867]: hal_bcm_console.c:294 LED: Loading 256 bytes into LED program memoryNov 12 12:20:05.092029 leaf01 switchd[9867]:Nov 12 12:20:05.099547 leaf01 switchd[9867]: hal_bcm_console.c:294 PORT: Error: bcm ports not initializedNov 12 12:20:05.099579 leaf01 switchd[9867]:Nov 12 12:20:05.099646 leaf01 switchd[9867]: hal_bcm_console.c:294 Error: file /var/lib/cumulus/rc.datapath_0: line 81 (error code -1): script terminatedNov 12 12:20:05.099667 leaf01 switchd[9867]:Nov 12 12:20:05.099775 leaf01 switchd[9867]: hal_bcm_console.c:294 Error: file /etc/bcm.d/rc.soc: line 70 (error code -1): script terminatedNov 12 12:20:05.099798 leaf01 switchd[9867]:Nov 12 12:20:05.099871 leaf01 switchd[9867]: hal_bcm_console.c:294 ERROR loading rc script on unit 0Nov 12 12:20:05.099892 leaf01 switchd[9867]:Nov 12 12:20:05.099943 leaf01 switchd[9867]: hal_bcm_console.c:299 CRIT loading of rc script failed, aborting!To work around this issue, configure Cumulus Linux to boot with the ntel_iommu=off kernel command option:1. Open the /etc/default/grub file with a text editor2. Edit the GRUB_CMDLINE_LINUX variable by adding the string intel_iommu=off at the end. For example: GRUB_CMDLINE_LINUX=“cl_platform=cel_e1031 console=ttyS1,115200n8 intel_iommu=off"3. Run the update-grub command4. Reboot the switch. |
3.7.11-4.2.1 | 4.3.0-4.4.5 |
| 2553887 |
When using TACACS+ configured with a DEFAULT user providing privilege level lower than 16, TACACS+ configured users with privilege level 16 access might not be able to run privilege level 16 NCLU commands, such as net add and net del and see an error similar to the following:
To work around this issue, remove the DEFAULT user from the TACACS+ server. |
3.7.7-3.7.16, 4.0.0-4.4.5 | |
| 2553748 |
On switches with the Spectrum ASIC, the IPv6 default route is present in the kernel but missing in hardware. | 3.7.11-4.2.1 | 4.3.0-4.4.5 |
| 2553530 |
In an MLAG configuration with a layer 3 VNI, when you bounce the peer link, all layer 2 VNIs listed under the layer 3 VNI are duplicated. To work around this issue, restart FRR with the sudo systemctl restart frr.service command. |
3.7.10-4.2.1 | 4.3.0-4.4.5 |
| 2553015 |
If a neighbour contains a special character in PortID for LLDP, the net show interface command does not display the LLDP information or the command might fail. |
3.7.10-3.7.16, 4.2.0-4.4.5 | |
| 2552739 |
Counters for IPROUTER rules do not increase when traffic is forwarded to the CPU because there is no IP neighbor. | 3.7.2-3.7.16 | |
| 2552647 |
When you add a member to a bond that has a subinterface configured (such as peerlink.4094), the new member is assigned only the VLAN of the subinterface for forwarding. To work around this issue, bounce the bond or shutdown the new interface and use the remaining members over the bond. |
3.7.10-4.2.0 | 4.2.1-4.4.5 |
| 2552528 |
Ingress SPAN/ERSPAN does not mirror packets when the next hop is EVPN encapsulated. | 3.7.7-4.2.1 | 4.3.0-4.4.5 |
| 2552506 |
Changing the order of the bridge ports might cause the bridge MAC address to change, which flaps the bridge and its ports. To work around this issue, manually set the MAC address of the bridge interface by adding hwaddress to the bridge stanza in the /etc/network/interfaces file. |
3.7.11-4.2.0 | 4.2.1-4.4.5 |
| 2552214 |
The Mellanox SN2700 and SN2410 switch intermittently reports PSU fan state changes with Unable to read from device/fan1_input/pwm1 syslog messages. |
3.7.11-3.7.14.2, 4.1.1-4.3.0 | 3.7.15-3.7.16, 4.3.1-4.4.5, 4.4.0-4.4.5 |
| 2551675 |
When you restart clagd, the edge port setting on the peer link changes. |
3.7.2-4.2.0 | 4.2.1-4.4.5 |
| 2551288 |
When you remove BFD configuration by editing the /etc/frr/frr.conf file and restarting FRR, you see a traceback.To work around this issue, either use NCLU or vtysh commands to remove the BFD configuration, or restart FRR with the new /etc/frr/frr.conf file. |
3.7.7-3.7.16 | 4.0.0-4.4.5 |
| 2551161 |
switchd memory utilization might continue to increase if there are excessive and continuous link flaps over a long period of time.To work around this issue, correct the cause of the frequent link flaps. You can restart switchd with the sudo systemctl restart switchd command to recover memory; this operation is impactful to all traffic on the switch during the restart. |
3.7.11-3.7.12, 4.0.0-4.2.0 | 3.7.13-3.7.16, 4.2.1-4.4.5 |
| 2550974 |
On the Dell S3000 switch, after installing the Cumulus Linux 4.1.1 disk image without a license, the switch sends a link beat if a remote host port is configured. | 3.7.11-3.7.16, 4.1.1-4.4.5 | |
| 2550942 |
NCLU tab completion for net show displays the text add help text instead of system Information for the system option. |
3.7.11-4.2.0 | 4.2.1-4.4.5 |
| 2550600 |
The received PVST BPDU for a VLAN is flooded even though the ingress port doesn’t have the VLAN tagged. | 3.7.8-3.7.14.2, 4.0.0-4.3.0 | 3.7.15-3.7.16, 4.3.1-4.4.5, 4.4.0-4.4.5 |
| 2550478 |
VXLAN interface as in-interface or out-interface in an ACL is not supported in Spectrum-based switches. | 3.7.7-4.2.0 | 4.2.1-4.4.5, 4.3.0-4.4.5 |
| 2550375 |
CPU utilization may increase when clag-managed bond interfaces are operationally/LACP down but the physical carrier remains up on the bond member switchports. This condition occurs when clag bond redirection is enabled and bond members remain up while the parent bond does not negotiate LACP. This issue is resolved in Cumulus Linux 3.7.14. |
3.7.9-4.2.1 | 4.3.0-4.4.5 |
| 2550350 |
Unicast traffic from downlink hosts is flooded to multiple remote VTEPs, which might also cause high HwIfOutQDrops/TX_DRP on the uplink ports. To work around this issue, restart switchd. |
3.7.10-4.1.1 | 4.2.0-4.4.5 |
| 2550323 |
After a neighbor is removed, the redistributed neighbor entry is withdrawn from the BGP table, but the prefix might still be selected as the bestpath when the host’s originated prefix is not advertised. To work around this issue, recreate the neighbor entry and flap the interface to the host. Or, if the host is already down, manually create a neighbor entry with an invalid MAC address, which forces redistribute neighbor to re-withdraw the entry. |
3.7.3-3.7.16 | 4.0.0-4.4.5 |
| 2549794 |
The asic-monitor.service fails when you configure /etc/cumulus/datapath/monitor.conf with monitor.histogram_pg.collect.port_group_list = [all_packet_pg] and there is traffic passing through the buffer. When the service fails, you see the following traceback in journalctl:
|
3.7.11-4.2.0 | 4.2.1-4.4.5 |
| 2549676 |
After you add or remove a bridge VLAN identifier (VID) on a trunk port, the layer 2 VNI is put into VLAN 1. To work around this issue, revert the configuration change. |
3.7.10-3.7.12, 4.0.0-4.1.1 | 3.7.13-3.7.16, 4.2.0-4.4.5 |
| 2549472 |
On switches with the Trident3 ASIC, PFC is not working as expected. If you set the PFC for only one CoS, pause frames are sent for all CoS traffic. | 3.7.11-4.1.1 | 4.2.0-4.4.5 |
| 2549371 |
When Optimized Multicast Flooding (OMF) is enabled with the bridge.optimized_mcast_flood = TRUE setting in the /etc/cumulus/switchd.conf file, the switch continues to flood IPv6 multicast traffic to all slave ports when there is no MLD join receive. |
3.7.11-4.3.3 | 4.4.0-4.4.5 |
| 2548930 |
On Mellanox Spectrum switches that contain an OSPF IP unnumbered neighborship with a high scale of prefixes being learned, a link flap might cause the neighbor entry to not be programmed in hardware. | 3.7.11-4.2.1 | 4.3.0-4.4.5 |
| 2548746 |
On the Broadcom switch with the Trident3 ASIC, packet priority remark values assigned from each internal CoS value continue to work with default values; if you change the internal CoS value, the change does not take effect. | 3.7.11-4.1.1 | 4.2.0-4.4.5 |
| 2548673 |
A large number of flapping peers causes FRR to require a corresponding update to internal data structures that track peer information. Updating this internal data structure does not delete links that are down due to the flapping. The size of this array then grows to contain both current peers as well as peers that should have been deleted during the flap processing. The contents of this array is processed by FRR to poll the links, which consumes CPU for all items in the array. This additional polling consumes more CPU than necessary but has no functional impact. To work around this issue, restart FRR. |
3.7.11-3.7.12, 4.0.0-4.1.1 | 3.7.13-3.7.16, 4.2.0-4.4.5 |
| 2548585 |
After you flap an MLAG peerlink, a rare condition might occur where routes and neighbors for VXLAN-enabled VLANs are misprogrammed as non-VXLAN routes and neighbors due to VNI state transitions. This results in a forwarding failure for traffic destined to these misprogrammed routes and neighbors. Note: Do not flap a VNI interface manually. The only expected time for a VNI interface to go down is when the MLAG secondary switch brings the VNIs protodown during a peer link failure where the backup IP address is still active. To recover from this condition, restart switchd with the sudo systemctl restart switchd command. |
3.7.10-3.7.12, 4.1.0-4.1.1 | 3.7.13-3.7.16, 4.2.0-4.4.5 |
| 2548490 |
A change in a route map prefix list that should remove a route might not be reflected in the ospf6 database or in peers, and the route might not be deleted. To work around this issue, reenter the redistribute <connected|static> route-map statement in the configuration. |
3.7.11-4.1.1 | 4.2.0-4.4.5 |
| 2548475 |
After you add a new VNI and a layer 3 SVI to a set of leafs, certain leafs might not be able to communicate on the layer 3 VNI. To work around this issue, reboot the leaf switch or restart switchd. |
3.7.6-3.7.16 | 4.0.0-4.4.5 |
| 2548382 |
The QuantaMesh BMS T3048-LY8 switch shows a low fan RPM in syslog. | 3.7.5-3.7.12, 4.0.0-4.1.1 | 3.7.13-3.7.16, 4.2.0-4.4.5 |
| 2548307 |
When the garbage collector does not release memory back to the operating system, clagd might consume a large amount of memory. As a result of low system memory, systemd might shut down services to reclaim memory. |
3.7.11-3.7.12, 4.1.0-4.1.1 | 3.7.13-3.7.16, 4.2.0-4.4.5 |
| 2548243 |
On switches with the Trident2+ ASIC, adding SPAN rules disables PBR rules. | 3.7.3-3.7.16, 4.0.0-4.4.5 | |
| 2548155 |
The net show bgp neighbor swpX json command shows negative output for the bgpTimerUpMsec timer. |
3.7.10-3.7.16 | 4.0.0-4.4.5 |
| 2548111 |
When you remove, then re-add an NSX VTEP binding, the VXLAN VTEP interface is not recreated. | 3.7.9-4.0.1 | 4.1.0-4.4.5 |
| 2548024 |
On the Dell Z9100 switch, 100G-SR4 modules might not link up reliably in certain ports. swp1, 2, 3, 9, 10, 23, 24, 30, 31, and 32 might be affected To work around this issue, move 100G SR4 modules to one of the ports not affected by this issue. |
3.7.11-4.1.1 | 4.2.0-4.4.5 |
| 2547942 |
On the Lenovo NE0152T switch, one power supply (PSU2) always show as ABSENT in smonctl. | 3.7.11-4.0.1 | 4.1.0-4.4.5 |
| 2547839 |
When you try to configure link-down on a parent interface of a subinterface configured in a VRF, you encounter an error. |
3.7.11-4.1.1 | 4.2.0-4.4.5 |
| 2547799 |
An error similar to the following shows in syslog for Mellanox switches:
To work around this issue, reboot the switch. |
3.7.11-4.0.1 | 4.1.0-4.4.5 |
| 2547784 |
PTM mis-detects incorrect hostnames of LLDP neighbors and does not fail them as expected. Instead they end up in an N/A cabling status. | 3.7.11-4.1.1 | 4.2.0-4.4.5 |
| 2547782 |
If a LLDP neighbor advertises a PortDescr that contains commas, ptmctl -d splits the string on the commas and misplaces its components in other columns. |
3.7.11-3.7.16, 4.0.0-4.4.5 | |
| 2547769 |
syslog might report a high load average with the CPU running a later microcode revision. |
3.7.4-3.7.12 | 3.7.13-3.7.16 |
| 2547706 |
When you configure ganged ports in the ports.conf file, the change does not take effect after you restart switchd. To work around this issue, reboot the switch. |
3.7.11-3.7.16, 4.0.0-4.4.5 | |
| 2547666 |
On the Dell S5232F-ON switch, the output of ledmgrd shows amber_blinking but smonctl shows all OK. |
3.7.11-3.7.12, 4.0.0-4.1.1 | 3.7.13-3.7.16, 4.2.0-4.4.5 |
| 2547663 |
When traffic from a double tag interface (facing a different site) is forwarded through VXLAN, the inner tag is not removed. The destination does not know this tag, so it discards it. | 3.7.8-4.0.1 | 4.1.0-4.4.5 |
| 2547659 |
On the EdgeCore AS7326-56X switch, the default fan speed, which is defined in the thermal specification, results in excessive fan noise. | 3.7.11-4.0.1 | 4.1.0-4.4.5 |
| 2547658 |
On the Lenovo NE0152T switch, one power supply (PSU2) always show as ABSENT in smonctl. | 3.7.11-3.7.12 | 3.7.13-3.7.16 |
| 2547609 |
Mellanox switches with the Spectrum A0 ASIC that are integrated with VMware NSX experience BFD connectivity issues with service nodes. As a result, VXLAN tunnels do not work. Mellanox switches with the Spectrum A1 ASIC do not have this issue. |
3.7.11-3.7.12, 4.0.0-4.1.1 | 3.7.13-3.7.16, 4.2.0-4.4.5 |
| 2547592 |
When you add a route map to advertise IPv4 unicast in a BGP EVPN configuration and the route map contains a set operation, BGP crashes. | 3.7.11-4.0.1 | 4.1.0-4.4.5 |
| 2547573 |
On Tomahawk switches, when the vxlan_tnl_arp_punt_disable option is set to FALSE, ARP packets are not forwarded to the CPU. |
3.7.9-3.7.16 | |
| 2547557 |
On the EdgeCore Wedge100 and Facebook Wedge-100S switch, certain physical ports are not correctly mapped to the logical ones. For example: Logical swp39 controls physical swp41 Logical swp40 controls physical swp42 Logical swp43 controls physical swp45 Logical swp44 controls physical swp46 This might causes incorrect forwarding behavior. |
3.7.11, 4.0.0-4.0.1 | 3.7.12-3.7.16, 4.1.0-4.4.5 |
| 2547508 |
When a Trident3 switch receives packets containing an IP checksum value that is not compliant with RFC 1624, the TTL is decremented after a routing operation but the checksum is not recalculated. This results in the IP checksum value being invalid as the packet leaves the switch. | 3.7.10-3.7.11, 4.0.0-4.0.1 | 3.7.12-3.7.16, 4.1.0-4.4.5 |
| 2547443 |
On the Dell N3248PXE-ON switch, 25G SFP ports do not work in 10G mode. | 3.7.11-4.0.1 | 4.1.0-4.4.5 |
| 2547381 |
The hsflowd service sends an undefined header protocol 0 in the sampled flow sample to the collector, which is not recognized by the sFlow tool. You see errors similar to the following:
|
3.7.11-3.7.16 | 4.0.0-4.4.5 |
| 2547349 |
When you change an interface IP address, then change it back, static routes are misprogrammed One of the following actions recovers the routes:- Bounce both layer 3 interfaces- Remove or add static routes in FRR- Restart FRR |
3.7.11-3.7.16 | 4.0.0-4.4.5 |
| 2547302 |
On the Dell Z9264F-ON switch, the CPU core temperature sensors report ABSENT. | 3.7.11, 4.0.0-4.0.1 | 3.7.12-3.7.16, 4.1.0-4.4.5 |
| 2547293 |
On the Broadcom Trident3 switch with DHCP relay, where the DHCP server is reachable through the EVPN overlay, DHCP discover packets forwarded to the CPU might appear corrupt and might not get forwarded. | 3.7.9-4.0.1 | 4.1.0-4.4.5 |
| 2547246 |
The MLAG switch pair has VLANs defined that are not used on MLAG bonds. These VLANs still synchronize MAC addresses across to the peer switch. This results in log messages that indicate a MAC address is installed and the VLAN is not defined; for example:
|
3.7.10-4.1.1 | 4.2.0-4.4.5 |
| 2547148 |
The last eight ports of the EdgeCore AS4610-54P switch (swp41 through swp48) do not power UPOE access points. | 3.7.11, 4.0.0-4.0.1 | 3.7.12-3.7.16, 4.1.0-4.4.5 |
| 2547147 |
The ospfd daemon might crash with the following kernel trace:
|
3.7.11-4.0.1 | 4.1.0-4.4.5 |
| 2547123 |
On the Broadcom switch with the Trident3 ASC, packet priority remark values assigned from each internal CoS value continue to work with default values; if you change the internal CoS value, the change does not take effect. | 3.7.11-4.1.1 | 4.2.0-4.4.5 |
| 2547121 |
An unhandled exception might occur after you run the sudo poectl -i command. In addition, random poed daemon restarts can occur without any unhandled exceptions but with an invalid response length error. Both issues can occur due to a SerialException.To work around this issue, power cycle the switch. A software reboot does not resolve the issue. |
3.7.10-3.7.11 | 3.7.12-3.7.16, 4.1.0-4.4.5 |
| 2547120 |
After you hot swap a PSU, the decode-syseeprom -t psuX command shows the old PSU information (such as the serial number), until you run the decode-syseeprom –init command. |
3.7.11-3.7.16, 4.0.0-4.4.5 | |
| 2547106 |
Editing the outbound route-map of a BGP peer causes all received prefixes by that BGP peer to reset and reinstall. This might cause a brief impact to traffic for those prefixes. | 3.7.11 | 3.7.12-3.7.16 |
| 2547100 |
On switches with the Trident3 ASIC, PFC is not working as expected. If you set the PFC for only one CoS, pause frames are sent for all CoS traffic. | 3.7.11-4.1.1 | 4.2.0-4.4.5 |
| 2547070 |
On the Lenovo NE2580 switch, the fan speeds are higher than expected within normal operating conditions. | 3.7.11, 4.0.0-4.0.1 | 3.7.12-3.7.16, 4.1.0-4.4.5 |
| 2547068 |
Hardware platforms using the Intel D-1500 CPU series might reboot unexpectedly To work around this issue, contact your hardware vendor to inquire if a new version of BIOS with a microcode fix is available or manually disable CPU C-states in the kernel as outlined below To permanently disable C-states using a kernel boot parameter:1. Edit /etc/default/grub to add the argument processor.max_cstate=0 to the variable GRUB_CMDLINE_LINUX. For example, if /etc/default/grub file contains the line GRUB_CMDLINE_LINUX=“cl_platform=accton_as7726_32x console=tty0 console=ttyS0,115200n8 intel_iommu=off pcie_aspm=off”, change it to GRUB_CMDLINE_LINUX=“cl_platform=accton_as7726_32x console=tty0 console=ttyS0,115200n8 intel_iommu=off pcie_aspm=off processor.max_cstate=0”2. Run sudo update-grub3. Reboot the system with sudo rebootTo disable cstates in realtime on the current system, which does not persist through a reboot:1. Confirm that the libpci3 package is installed. Run dpkg-query -l libpci3 and confirm the following line is displayed:ii libpci3:amd64 1:3.2.1-3 amd64 Linux PCI Utilities (shared library)The first field above should read ii. If not, install the libpci3 package by running sudo apt upgrade;sudo apt install libpci32. Disable C-states by running the command ./cpupower idle-set -d 2C-states are disabled by default in Cumulus Linux 4.3.0 and later. |
3.7.9-4.2.1 | 4.3.0-4.4.5 |
| 2547042 |
After you convert a bond back to a layer 2 access port, ifupdown2 changes all SVI MTUs to 1500. To work around this issue, run ifreload -a a second time. |
3.7.11, 4.0.0-4.0.1 | 3.7.12-3.7.16, 4.1.0-4.4.5 |
| 2547012 |
On the Mellanox Spectrum switch, switchd can sometimes fail when PBR rules are installed or removed from hardware if the rule is setting a next hop learned via a routing protocol. |
3.7.7-3.7.11, 4.0.0-4.0.1 | 3.7.12-3.7.16, 4.1.0-4.4.5 |
| 2546998 |
When you configure Cumulus Linux with a /32 address on a switch port with a configured peer address (for example, to connect to a device using IP unnumbered), the switch sends GARPs for the peer address. | 3.7.5-3.7.11 | 3.7.12-3.7.16, 4.1.0-4.4.5 |
| 2546991 |
The FRR service does not provide a way for automation to know if the configuration applied properly. To work around this issue, execute the vtysh -f command in the automation file before starting the FRR service to validate the functional configuration and return an error code. |
3.7.11-3.7.16, 4.0.0-4.4.5 | |
| 2546984 |
On the EdgeCore AS7326-56X switch, the PSU fans show constant LOW warnings. | 3.7.10-3.7.12, 4.0.0-4.2.0 | 3.7.13-3.7.16, 4.2.1-4.4.5 |
| 2546950 |
switchd crashes when dynamic VRF route leaking is enabled and the following is true:* The default route is leaked from VRF1 to VRF2 * Hardware-based dynamic VRF route leaking is configured ( vrf_route_leak_enable_dynamic is set to TRUE in the /etc/cumulus/switchd.conf file). You might see logs similar to the following in /var/log/syslog:
To work around this issue, use a route map to filter the default route (the source VRF is imported into the destination VRF). |
3.7.10-3.7.12, 4.0.0-4.1.1 | 3.7.13-3.7.16, 4.2.0-4.4.5 |
| 2546895 |
If you have configured a higher number of ports and VLANs (ports x VLANs) or the switch is a lower-powered (CPU) platform, the switchd service might fail to send a systemd keepalive within the watchdog timeout value (2 minutes by default) and you see an error similar to the following:bq. systemd[1]: switchd.service watchdog timeout (limit 2min)!To workaround this issue, either reduce the number of configured interfaces and, or VLANs, or increase the systemd timeout for switchd.serviceTo increase the systemd timeout:1.Edit the /etc/systemd/system/switchd.service.d/override.conf file and increase the WatchdogSec parameter2.Restart the switchd service with the sudo systemctl restart switchd.service commandsystemd attempts to restart the switchd service automatically (after the watchdog timeout). If the restart fails multiple times in a short time period, run the sudo systemctl reset-failed command followed by the sudo systemctl restart switchd command. |
3.7.11-3.7.16, 4.0.0-4.4.5 | |
| 2546868 |
Broadcom Field Alert - SID - MMU 2B Errors A few of the MMU memories on Broadcom switches are grouped together with single parity control. During SER correction when a parity error occurs on one of those groups, other memory in that group might also report a SER error. This occurs when the memory is accessed either by a packet hit or through a schan operation. This issue can cause SER errors in other memory and cause traffic mis-forwarding or a packet drop. |
3.7.0-3.7.11, 4.0.0-4.0.1 | 3.7.12-3.7.16, 4.1.0-4.4.5 |
| 2546815 |
On the Delta AG6248C switch, the NCLU net show system sensors command shows an error:
To work around this issue, run the net show system sensors json command instead. |
3.7.11 | 3.7.12-3.7.16 |
| 2546702 |
The FRR cl-support module times out on switches on the ARM platform even when the switch is not under heavy load. To work around this issue, run the cl-support -M command to disable timeouts. |
3.7.0-3.7.11, 4.0.0-4.0.1 | 3.7.12-3.7.16, 4.1.0-4.4.5 |
| 2546577 |
A traditional bridge with QinQ and a VNI does not work for tagged traffic. | 3.7.10-4.0.1 | 4.1.0-4.4.5 |
| 2546564 |
You might see a switchd memory leak during ECMP group expansion or consolidation. |
3.7.10-3.7.11 | 3.7.12-3.7.16 |
| 2546501 |
On the EdgeCore AS7326-56X switch, eth0 and swp1 use the same MAC address. | 3.7.9-3.7.11, 4.0.0-4.0.1 | 3.7.12-3.7.16, 4.1.0-4.4.5 |
| 2546450 |
On the EdgeCore AS7326-56X switch, you might see the RPM of certain fans run over the maximum threshold. | 3.7.11-3.7.16 | |
| 2546385 |
SNMP ifLastChange reports link transitions when there are none. | 3.7.6-3.7.16 | |
| 2546328 |
A memory leak in switchd might occur, which causes switchd to restart. |
3.7.10-3.7.11, 4.0.0-4.0.1 | 3.7.12-3.7.16, 4.1.0-4.4.5 |
| 2546264 |
Ifupdown2 does not set up the front panel interface for the dhclient to accept the DHCP OFFER.To work around this issue, restart the networking service after ifreload -a with the systemctl restart networking command. |
3.7.10-3.7.11, 4.0.0-4.0.1 | 3.7.12-3.7.16, 4.1.0-4.4.5 |
| 2546225 |
When you execute the following command on the Delta AG6248C switch, the switch reboots and then comes right back into Cumulus Linux without installing the new image. The install image is still in /var/lib/cumulus/installer, which causes issues with cl-support.
To work around this issue, use the onie-select command to access ONIE, and then use the nos-install command in ONIE to install a new binary image. |
3.7.11-3.7.16, 4.0.0-4.4.5 | |
| 2546203 |
When using QinQ with a traditional bridge, if you enable the LLDP dot1 TLV option, you see the following suboptimal behavior: * Both the inner and outer VLAN information is sent as part of VLAN TLVs in the LLDP packet. * If the outer VLAN ID is the same as the inner VLAN ID, only one VLAN TLV is sent with that VLAN ID in the LLDP packet. |
3.7.11-3.7.16 | |
| 2546141 |
CPU usage might be higher than normal if you have a high number of interfaces x VLANs and lldpd is active. This issue is introduced with code changes in Cumulus Linux 3.7.11, where VLAN information is now available for LLDP to advertise to neighbors ([https://docs.cumulusnetworks.com/version/cumulus-linux-37/Layer-2/Link-Layer-Discovery-Protocol/#vlan-dot1-tlv]). You might see high CPU usage even if VLAN (dot1) TLV configuration is disabled. To check if lldpd is the heavy CPU resource user, run the following command:
Alternatively, check for messages in the /var/log/syslog directory similar to:
Note: The exact amount of CPU usage varies in each network based on a number of factors; however, it is unusual for lldpd to consume more than 30% CPU for an extended period of time.To work around this issue, you can do one of the following: * If the large number of VLANs is not absolutely necessary, manually prune the VLAN allowed list (if you use the range 1-2999, modify the bridge-vids list to include the VLANs being used).* Stop the lldpd service. (This approach might be undesirable if the switch is providing services that rely on LLDP such as Voice VLAN.) To stop the lldpd service (runtime setting), run the sudo systemctl stop lldpd.service command. To disable the lldpd service upon boot, run sudo systemctl disable lldpd.service. |
3.7.11-4.0.1 | 4.1.0-4.4.5 |
| 2546131 |
On the Delta AG-6248C PoE switch, when you run the apt upgrade command, the upgrade does not work. Cumulus Linux uses uboot directly instead of grub to boot the kernel. Uboot needs a special header to boot the kernel, which is not present. Without this header, when you use the apt upgrade command to upgrade Linux packages, uboot is unable to boot up the kernel. To work around this issue, upgrade Cumulus Linux by installing the Cumulus Linux image. Run the onie-select command to go into ONIE, and then use the nos-install command in ONIE to install a new image.This workaround only works when an out-of-band network is present. |
3.7.11-3.7.16, 4.0.0-4.4.5 | |
| 2546010 |
When hal.bcm.per_vlan_router_mac_lookup is set to TRUE in the /etc/cumulus/switchd.conf file, inter-VLAN traffic is forwarded to the CPU when associated VNI interfaces exist. |
3.7.10-3.7.16 | |
| 2546003 |
On the Delta AG6248C PoE switch, if the PoE priority is set to low on some ports, other ports with a higher priority might have their requests to draw power rejected instead of the lower priority ports being brought down. | 3.7.11 | 3.7.12-3.7.16 |
| 2545997 |
The NCLU command net show interface produces an error if bonds with no members exist.To work around this issue, remove the empty Bond interfaces from the /etc/network/interfaces file and run sudo ifreload -a. |
3.7.10-3.7.16 | |
| 2545971 |
The ports.conf file on the Dell S5248F-ON switch does not show port ganging or breakout options. |
3.7.10-3.7.11 | 3.7.12-3.7.16, 4.1.0-4.4.5 |
| 2545948 |
All Broadcom Trident3 X7 switches contain PCIE firmware, which is programmed by the vendor when the switch is manufactured. The latest version of this firmware (2.6) is incompatible with Cumulus Linux 3.7.11 and earlier, and Cumulus Linux 4.0. To work around this issue, downgrade the Broadcom ASIC firmware to an earlier version. |
3.7.11, 4.0.0-4.0.1 | 3.7.12-3.7.16, 4.1.0-4.4.5 |
| 2545837 |
If you use the NCLU commands to configure NTP and run the net add time ntp source command before you run the net add time ntp server command, the /etc/ntp.conf file is misconfigured.To work around this issue, run the net add time ntp server command before you run the net add time ntp source command. |
3.7.10-3.7.11, 4.0.0-4.4.5 | 3.7.12-3.7.16 |
| 2545699 |
On the Celestica Pebble switch, if you use IPv6 routes with mask /65 to /127, the switchd log fills with errors. |
3.7.10-4.0.1 | 4.1.0-4.4.5 |
| 2545599 |
IPv6 table rules might affect forwarding. For example, if you create the following rule in the /etc/cumulus/acl/policy.d/03-sshd.rules file, the rule counter increments but IPv4 SSH traffic might be dropped.
|
3.7.2-3.7.11, 4.0.0-4.0.1 | 3.7.12-3.7.16, 4.1.0-4.4.5 |
| 2545446 |
If you use NCLU commands to add a non-MLAG bond, then add an MLAG configuration, the net commit command fails. However, a subsequent net commit command succeeds. |
3.7.10-3.7.16 | |
| 2545404 |
On the Trident3 switch, unicast ARP packets received on a VNI and forwarded to the CPU are not policed. | 3.7.10-4.0.1 | 4.1.0-4.4.5 |
| 2545316 |
When an interface flap occurs, numbered IPv6 BGP sessions might fail to establish. To work around this issue, run the ip -6 route flush cache command to flush the IPv6 route cache. |
3.7.9-3.7.11 | 3.7.12-3.7.16 |
| 2545125 |
If you configure more than one VRR interface on an SVI interface, deleting one of the VRR addresses does not remove the interface/address. | 3.7.10-3.7.16, 4.0.0-4.4.5 | |
| 2544978 |
If you delete an undefined bond, then add a bond slave, the net commit command fails. |
3.7.9-3.7.16, 4.0.0-4.4.5 | |
| 2544968 |
FRR configuration commands for an SVI interface might have the \n misplaced in the output. For example:
should be:
To work around this issue, configure the interface manually in the /etc/frr/frr.conf file. |
3.7.9-3.7.16, 4.0.0-4.4.5 | |
| 2544953 |
When you update the hostname of a switch with the NCLU net add hostname command, then run net commit, the lldpd service does not restart and other devices still see the old hostname.To work around this issue, run the sudo systemctl restart lldpd.service command. |
3.7.10-3.7.16, 4.0.0-4.4.5 | |
| 2544937 |
The neighmgrd service does not ignore neighbors on reserved devices (lo and management devices). This issue is not seen when management VRF is enabled. |
3.7.8-3.7.11 | 3.7.12-3.7.16 |
| 2544904 |
After you delete an IPv6 numbered BGP peer group neighbor, Cumulus Linux might continue to send route advertisements. To work around this issue, restart FRR after removing the IPv6 numbered configuration. |
3.7.9-4.1.1 | 4.2.0-4.4.5 |
| 2544829 |
Frames received with a VLAN tag of 0 on an interface configured as a bridge port and forwarded to the CPU for processing might appear tagged with the native VLAN when viewed with tcpdump. |
3.7.8-3.7.16 | |
| 2544556 |
If you reconfigure an NTP server with NCLU using different trailing options after the IP address (such as iburst), an invalid configuration is added to the /etc/ntp.conf file. For example:
If you need to alter existing server configurations, first remove the server, commit, then re-add the server with any trailing options. |
3.7.9-4.1.1 | 4.2.0-4.4.5 |
| 2544463 |
Auto-negotiation does not work with the QSFP28 cables and a remote system operating at 10G. Attempting to enable auto-negotiation with ethtool -s swp<#> autoneg on returns Operation not supported.To work around this issue, do not use auto-negotiation and set the local port speed to 10G. |
3.7.9-3.7.16, 4.0.0-4.4.5 | |
| 2544456 |
The NCLU net show lldp command displays the speed of a ganged port group as the speed of one of the individual links, rather than the sum of their speeds. |
3.7.9-3.7.16, 4.0.0-4.4.5 | |
| 2544311 |
Applying a policy-based routing (PBR) rule for all traffic from a host might disrupt ARP refresh for that connected host. | 3.7.5-3.7.16, 4.0.0-4.4.5 | |
| 2544155 |
NCLU requires you to specify an interface with multiple address-virtual statements in ascending MAC address order. |
3.7.5-3.7.16, 4.0.0-4.4.5 | |
| 2544113 |
Mac learning is not disabled by default on a double tagged peer link interface resulting in the MAC address changing between the MLAG bond and the peer link. To work around this issue, disable MAC learning on QinQ VLANs by adding bridge-learning off to the VLAN stanza in the etc/network/interfaces file. |
3.7.9-3.7.16, 4.0.0-4.4.5 | |
| 2544012 |
After you remove a subinterface, the BGP session stays in a Connect state. | 3.7.8-3.7.11 | 3.7.12-3.7.16 |
| 2543900 |
On the Mellanox switch, static VXLAN tunnels incorrectly allow traffic from any remote tunnel IP address. | 3.7.8-3.7.16, 4.0.0-4.4.5 | |
| 2543841 |
The net show evpn vni detail json command includes an extra empty dictionary at the end of the output. |
3.7.8-3.7.16, 4.0.0-4.4.5 | |
| 2543840 |
On the Mellanox SN2700 switch, you cannot enable resilient hashing (RASH) and set the bucket size to 64 in the traffic.conf file. |
3.7.6-3.7.16 | |
| 2543816 |
On the Dell S5248F-ON switch, smond might generate syslog messages indicating that the fan input RPM is lower than the normal low speed of 2500 RPM. Speeds as low as 1700 RPM are acceptable in normal thermal environments; therefore, you can ignore these messages. |
3.7.6-3.7.11, 4.0.0-4.4.5 | 3.7.12-3.7.16 |
| 2543800 |
When local-tunnelip is an SVI, the static VXLAN tunnel does not work; the next hop router receives the packet but drops it as it does not know where to forward the packet. The static VXLAN tunnel does works if local-tunnelip is a loopback or a physical layer 3 interface. |
3.7.8-3.7.16 | 4.0.0-4.4.5 |
| 2543792 |
On the EdgeCore AS5712, AS6712, AS5812 and AS6812 switch, support for multiple PSU types results in log messages similar to the following:
|
3.7.9-4.0.1 | 4.1.0-4.4.5 |
| 2543648 |
You cannot specify a source and destination MAC address in an ERSPAN ebtables rule. For example, the following rule does not work:
|
3.7.6-3.7.12, 4.0.0-4.1.1 | 3.7.13-3.7.16, 4.2.0-4.4.5 |
| 2543647 |
ERSPAN in ebtables does not work for VNIs. For example, the following rule does not work:
|
3.7.6-4.2.1 | 4.3.0-4.4.5 |
| 2543646 |
In an ebtables rule, ERSPAN (upper case) does not work. You need to specify erspan (lower case). | 3.7.6-3.7.16, 4.0.0-4.4.5 | |
| 2543627 |
Tomahawk 40G DACs cannot disable auto-negotiation. | 3.7.7-3.7.16 | 4.0.0-4.4.5 |
| 2543472 |
On switches with the Spectrum ASIC, the underlay hashes VXLAN packets for a given overlay flow randomly. To work around this issue, configure the ECMP hash seed to the same value on the EVPN egress leaf switches. |
3.7.7-4.0.1 | 4.1.0-4.4.5 |
| 2543270 |
The default route injected through OSPF when you configure default-information originate always is unreliable and might age out unexpectedly.To work around this issue, rely on a different source of default route other than injection with default-information originate. |
3.7.8-4.1.1 | 4.2.0-4.4.5 |
| 2543211 |
In some cases, the switchd service might warn of excessive MAC moves from one switch port to itself (for example, from swp18 to swp18). |
3.7.0-3.7.16, 4.0.0-4.4.5 | |
| 2543164 |
The MTU of an SVI cannot be higher than the MTU on the bridge. Changing the MTU on the SVI with NCLU does not update the bridge MTU. The net commit command succeeds even though the MTU is not changed as expected.To work around this issue, change the MTU on all SVIs and the bridge manually in the /etc/network/interfaces file, then apply the change with the ifreload -a command. |
3.7.7-3.7.16, 4.0.0-4.4.5 | |
| 2543096 |
When an SVI with a virtual MAC is configured with a layer 2 VNI in an EVPN environment, if you replace the /etc/network/interfaces file with a different file that does not have the SVI and layer 2 VNI configuration, the original virtual MAC is not populated through the EVPN route until FRR is restarted. |
3.7.6-3.7.16, 4.0.0-4.4.5 | |
| 2543058 |
The IP neighbor entry for a link-local next hop is not installed by FRR, which results in a forwarding failure for routes via that next hop. This is a rare problem that occurs with IPv4 route exchange over IPv6 GUA peering with no IPv4 addresses on the interfaces. To work around this issue, flap the peering to the peer router (which might be a route reflector) to recover. To avoid this issue, configure IPv6 router advertisements on the connecting interfaces. |
3.7.7-3.7.16 | 4.0.0-4.4.5 |
| 2543052 |
Received EVPN type-5 and type-2 MACIP routes are not installed in the kernel (and hardware) routing tables for the associated VRF, which causes traffic to be blackholed. The failure to install the default route causes complete reachability failure for the particular tenant on the affected racks. The routes that are not installed are seen as “inactive” in the routing subsystem (FRR) VRF routing table. This problem is rare and can occur only in EVPN configurations that have user-configured route targets (RTs) for tenant VRFs, and only following a restart of FRR. To work around this issue, either restart the FRR service on the affected switch with the sudo systemctl restart frr.service command or bounce the layer 3 SVI for the affected VRF; for example:
You can run the net show vrf vni command to print a mapping of VRF : L3-VNI : L3-SVI. |
3.7.5-3.7.16 | 4.0.0-4.4.5 |
| 2543044 |
Under certain conditions, EVPN next hops might not be removed when the contributing peer goes down or might not be populated when the BGP session to the contributing peer comes up. You can prevent EVPN next hops from not being removed when the contributing peer goes down by specifying static MAC addresses on all layer 3 VNIs. There is no workaround for preventing EVPN next hops from not being populated when the BGP session to the contributing peer comes up. |
3.7.2-3.7.16 | 4.0.0-4.4.5 |
| 2542979 |
On the Dell-N3048EP-ON switch, when you run the sudo -E apt upgrade command, the upgrade does not work. |
3.7.7-4.1.1 | 4.2.0-4.4.5 |
| 2542945 |
On the Broadcom Maverick switch with a QinQ configuration, the packets coming into the CPU might be tagged incorrectly; for example, 802.1ad + 802.1q tags are expected in the packets but the packets have 802.1q + 802.1q tags. To work around this issue, configure the bridge with bridge-vlan-protocol 802.1ad:
|
3.7.6-3.7.16, 4.0.0-4.4.5 | |
| 2542823 |
On the Broadcom Trident 3 switch, VXLAN encapsulated packets are dropped on the ingress port (tagged layer 2 port) during transit forwarding (the local switch does not terminate the VXLAN tunnel). An example of where this two-layer VXLAN inside VXLAN encapsulation might occur: - VXLAN tunnel (#1) between two servers (different racks) to provide layer 2 extension for containers or VM hosts. - VXLAN tunnel (#2) between the TOR switch in rack 1 to the TOR switch located in the remote rack. To work around this issue, either: - Configure the edge port (facing the servers) to be an access port (instead of a trunk/tagged port) - Change the destination port from 4789 to something else (VXLAN tunnel terminated by the servers) |
3.7.5-3.7.11, 4.0.0-4.0.1 | 3.7.12-3.7.16, 4.1.0-4.4.5 |
| 2542767 |
If the BMC operating system fails to respond to IPMI, you see a traceback in bmcd and all the sensors might report ABSENT devices in smonctl. To work around this issue, power cycle the switch. |
3.7.6-4.0.1 | 4.1.0-4.4.5 |
| 2542310 |
hsflow disregards the setting for agent.cidr in the /etc/hsflowd.conf file and selects an IPv6 agent address. The source IP address of the hsflowd packet is IPv4, but the agent address in the hsflow payload shows IPv6. |
3.7.6-3.7.16 | |
| 2542305 |
If an SVI exists in the configuration before you assign it an IP address, when you do assign the IP address with the NCLU command, the vlan-id and the raw-device bridge stanzas are not added automatically. |
3.7.6-3.7.16, 4.0.0-4.4.5 | |
| 2542301 |
When first creating a bond and enslaving an interface, NCLU hides some of the bridge command suggestions, although they are still accepted. |
3.7.3-3.7.16, 4.0.0-4.4.5 | |
| 2541212 |
The maximum-prefix configuration under the IPv4 address family has an optional restart value, which you can configure. This configuration is ignored and, instead of restarting the sessions every x minutes, the peer constantly changes between established and idle due to the prefix count being exceeded. |
3.7.5-3.7.16, 4.0.0-4.4.5 | |
| 2541165 |
On the Dell N3048EP-ON switch, UPOE is supported only on ports 1 thru 12. (UPOE uses all four pairs of standard Ethernet cabling whereas PoE delivers power over two twisted pairs.) When you plug a UPOE device in a port higher than port 12, poectl reports that four_pair_mode_enabled is true. However, this configuration is not supported on the port so poectl should report that four_pair_mode_enabled is false. |
3.7.6-3.7.16 | |
| 2541029 |
On switches with the Trident2 ASIC, 802.1Q-encapsulated control plane traffic received on an interface with 802.1AD configured subinterfaces might be dropped. This issue only affects QinQ configurations. |
3.7.5-3.7.16, 4.0.0-4.4.5 | |
| 2540950 |
On the QuantaMesh T4048-IX8 or EdgeCore AS7326-56X switch, when using a 1000BASE-T SFP module, the module LEDs do not light to reflect link status. |
3.7.3-4.1.1 | 4.2.0-4.4.5 |
| 2540885 |
The Dell N3048EP-ON switch does not support 1G Base-T modules in the SFP ports. | 3.7.7-3.7.16 | |
| 2540863 |
On the EdgeCore AS5812-54X switch, the PSU2 Fan1 fluctuates between OK and LOW. When the fan speed is reported as LOW, the RPM is shown as a negative number. |
3.7.3-3.7.16 | |
| 2540753 |
If the interface alias contains a single or double quotation mark, or an apostrophe, the net show configuration commands fail with the following error:
|
3.7.5-3.7.16, 4.0.0-4.4.5 | |
| 2540444 |
SNMP incorrectly requires engine ID specification. |
3.7.4-3.7.16, 4.0.0-4.4.5 | |
| 2540352 |
When you use NCLU to configure a route map, the parser allows for glob matching of interfaces for a match interface condition when there can only be a single interface matched. The proper syntax is to use multiple route map clauses, each matching a single interface, instead of a single clause matching multiple interfaces. For example, this command is incorrect:
These commands are correct:
|
3.7.2-3.7.16, 4.0.0-4.4.5 | |
| 2540340 |
NCLU allows for the configuration of addresses on VRF interfaces, but tab completion for the net add vrf command just displays
Tab completion for the net add vrf command works correctly. |
3.7.4-3.7.16, 4.0.0-4.4.5 | |
| 2540274 |
On the Maverick switch, CPU forwarded packets might be dropped when there is no route to a leaked host route. | 3.7.5-3.7.16, 4.0.0-4.4.5 | |
| 2540204 |
When links come up after FRR is started, VRF connected routes do not get redistributed. | 3.7.4-3.7.16, 4.0.0-4.4.5 | |
| 2540192 |
The net del bridge bridge mcsnoop yes command does not return the value to the default of disabled. To work around this issue, use the net add bridge bridge mcsnoop no command to delete the mcsnoop attribute and return to the default value. |
3.7.4-3.7.16, 4.0.0-4.4.5 | |
| 2540155 |
On the Broadcom switch, when moving configuration from bridged to routed (or toggling from routed to bridged to routed), some traffic is not seen by the kernel. This can cause BGP to not establish on a transit node. |
3.7.3-3.7.16, 4.0.0-4.4.5 | |
| 2540042 |
When you try to configure the VRRP priority and advertisement-interval with NCLU on a traditional mode bridge, the net commit command fails. To work around this issue, use the vtysh command (inside FRR) to change the VRRP priority or advertisement-interval on traditional bridges. For example:
|
3.7.4-3.7.16, 4.0.0-4.4.5 | |
| 2540041 |
On SVIs in a VLAN-aware bridge, you cannot change the VRRP priority with NCLU. To work around this issue, run the vtysh command inside FRR to change the default priority. For example:
|
3.7.4-3.7.16, 4.0.0-4.4.5 | |
| 2540040 |
Cumulus Linux uses VRRPv3 as the default version, and enables both preempt and accept mode by default. You cannot change these default values with NCLU. To work around this issue, run the vtysh commands (inside FRR) to change the default values. For example:
|
3.7.4-3.7.16, 4.0.0-4.4.5 | |
| 2540031 |
NCLU does not honor auto all in the /etc/network/interfaces file and removes the existing configuration if no individual auto lines exist. |
3.7.3-3.7.16, 4.0.0-4.4.5 | |
| 2539994 |
When you try to remove a BGP peer group configuration with NCLU, the command fails but no warning message is shown. For example:
|
3.7.2-3.7.16, 4.0.0-4.4.5 | |
| 2539962 |
When an LDAP user that does not have NCLU privileges (either in the netshow or netedit group, or in the /etc/netd.conf file) runs an NCLU command, a traceback occurs instead of a permissions error. |
3.7.0-3.7.16, 4.0.0-4.4.5 | |
| 2539670 |
On the Edgecore 4610-54P switch, automatic medium-dependent interface crossover (auto-MDIX) stops working on a 100M full duplex interface and does not detect the required cable connection type. |
3.7.2-3.7.16, 4.0.0-4.4.5 | |
| 2539124 |
The net add interface command adds no ptm-enable for that interface in the frr.conf file. Running the net add or the net del command does not remove no ptm-enable from the frr.conf file. You have to remove it manually using vtysh. |
3.7.2-3.7.16, 4.0.0-4.4.5 | |
| 2539081 |
When you delete post-up and pre-down IP peer entries from the etc/network/interfaces file, then run the ifreload command, the IP addresses are not removed and the route remains in the route table. To work around this issue, either delete the IP addresses without the /32 mask component or flush the IP addresses for the interface with the ip addr flush dev command. |
3.7.0-3.7.16 | 4.0.0-4.4.5 |
| 2538875 |
IPv6 multicast traffic destined to an unregistered multicast group is flooded to all ports in a bridge despite the bridge.optimized_mcast_flood = TRUE setting in the /etc/cumulus/swichd.conf file. |
3.7.2-3.7.16 | |
| 2538790 |
NCLU automatically adds the VLAN ID (for the layer 3 VNI/SVI) to the bridge when you run net add vxlan . This configuration breaks network connectivity in an EVPN symmetric routing configuration using MLAG. To restore connectivity, remove the VLAN ID from the bridge. |
3.7.2-3.7.16, 4.0.0-4.4.5 | |
| 2538590 |
When you configure a control plane ACL to define permit and deny rules destined to the local switch, NCLU programs the control plane ACL rules into the FORWARD chain. |
3.7.2-3.7.16, 4.0.0-4.4.5 | |
| 2538562 |
On an RMP/1G-T switch, when you remove link-speed 100 with the NCLU command or by editing the etc/network/interfaces file to revert the 100M interface to the default (1G auto), the interface fails to recover and does not come back up.After you remove the link-speed, ethtool shows the advertised link modes as not reported and Speed/Duplex as unknown.To work around this issue and bring the interface back up, either restart switchd or use ethtool to configure the speed, advertised, duplex or MDI-X settings. Note: The advertised link mode gets set incorrectly if you include 1000baseT/Half. The port will come up successfully at 1G. |
3.7.2-3.7.16, 4.0.0-4.4.5 | |
| 2538302 |
portwd allows an error to change the module type based on the error. For example, a bad write to a module might cause the module type to flap, which causes the link itself to flap. |
3.7.0-3.7.16 | |
| 2538294 |
If you use NCLU to create an iBGP peering across the peer link, running the net add bgp l2vpn evpn neighbor peerlink.4094 activate command creates a new eBGP neighborship when one has already been configured for iBGP. This is unexpected; the existing iBGP configuration is valid. |
3.7.0-3.7.16, 4.0.0-4.4.5 | |
| 2538256 |
On the Broadcom switch, when a link-local multicast frame is received on an access port with a VNI in the bridge, two copies of the packet are sent across the VNI to remote VTEPs and the receiving hosts observe duplicate packets. |
3.7.2-4.0.1 | 4.1.0-4.4.5 |
| 2537819 |
When you enable FEC (RS or BaseR) on an interface, removing the configuration from that interface does not revert the FEC status to off/none. |
3.7.2-3.7.16 | 4.0.0-4.4.5 |
| 2537699 |
There is a limitation on the number of SVI interfaces you can specify as DHCP relay interfaces in the /etc/default/isc-dhcp-relay file. For example, 1500 SVI interfaces causes the dhcrelay service to exit without a core file and logs similar to the following are generated for the interfaces:
Eventually the dhcrelay service stops. |
3.7.1-3.7.16, 4.0.0-4.4.5 | |
| 2537544 |
When you run the mstpctl command, you might see the bridge-port state as blocking when it is actually disabled. You might see the same incorrect bridge-port state when other programs or tools use the output of mstpctl; for example, SNMP output from the BRIDGE-MIB. |
3.7.1-3.7.16, 4.0.0-4.4.5 | |
| 2537378 |
NCLU SNMPv3 user configuration (add, delete, modify) does not complete. Changes are made to the /etc/snmp/snmpd.conf file but the SNMPv3 user cache file /var/lib/snmp/snmpd.conf fails to update correctly and the configuration does not reflect in operation. To work around this issue, stop snmpd, remove the cache file, then restart snmpd. |
3.7.1-3.7.16 | |
| 2537188 |
When an event in the network, such as a switchd or networking service restart, leads to an OVSDB server high availability transition, an ovs-vtepd core might occur. This core generation has no effect on the functionality of high availability when the active OVSDB server is back in the network. |
3.7.2-3.7.16 | |
| 2537104 |
When you try to stop hsflowd on the Trident II+ switch with the systemctl stop hsflowd command, the process hangs until you stop it with SIGKILL. |
3.7.1-3.7.16 | 4.0.0-4.4.5 |
| 2537061 |
The Dell S5048F-ON switch (with reverse airflow, rear to front), shows the Temp-3 sensor as absent. |
3.7.1-4.0.1 | 4.1.0-4.4.5 |
| 2536608 |
Single tagged ARP requests received on a QinQ-over-VXLAN access port are dropped if ARP suppression is enabled on an unrelated VNI. |
3.7.0-3.7.16 | |
| 2536384 |
The BFD packet redirection logic used by OVSDB server high availability mode redirects BUM packets across the peer link. The iptables rule for redirection does differentiate between BFD and non-BFD VXLAN inner packets because the service node sends all frames with its own IP address as the tunnel source IP address. The VXLAN encapsulated BUM packets do not get forwarded to the CPU and do not go through the iptable redirection rule; only VXLAN encapsulated BFD packets get forwarded to the CPU due to the inner MAC DA lookup in hardware. |
3.7.0-3.7.16, 4.0.0-4.4.5 | |
| 2536179 |
On switches with the Trident 2+ ASIC, counters associated with VLANs and VRFs are not working. | 3.7.0-3.7.16, 4.0.0-4.4.5 | |
| 2535986 |
At a high CPU transmit traffic rate (for example, if there is unexpected CPU generated flooding or replication in software), when the ASIC packet driver cannot keep up with the transmit rate because there are no free DMA buffers, it can back pressure by suspending the switch port transmit queues. This can fill up the application socket buffers resulting in No buffer space available error messages on protocol sockets.When the driver recovers, it automatically resumes the transmit queues. In most cases these error messages are transient. In rare cases, the hardware queues might get stuck, which you can recover with a switchd restart. |
3.7.0-3.7.16, 4.0.0-4.4.5 | |
| 2535965 |
On the Trident3 switch, static PIM with IIF based on a layer 2 bridge does not work reliably. PIM Join via signaling is required for IPMC to work properly. To work around this issue, use dynamic signaling (joins) to manage IP multicast traffic. |
3.7.0-3.7.16, 4.0.0-4.4.5 | |
| 2532017 |
In FRR, bgp_snmp does not show all BGP peers when peer groups used. |
3.7.11-4.0.1 | 4.1.0-4.4.5 |
Fixed Issues in 3.7.11
| Issue ID | Description | Affects |
|---|---|---|
| 2545867 |
If you delete, then re-add a PBR policy on an interface, the configured PBR policy is not programmed in the kernel or switchd. |
3.7.9-3.7.10, 4.0.0-4.0.1 |
| 2545865 |
After making a series of PBR configuration changes using NCLU commands, the stale PBR entry is still present in the kernel. | 3.7.9-3.7.10, 4.0.0-4.0.1 |
| 2545693 |
On rare occasions, after rebooting the MLAG secondary switch, one MLAG device might see the peer as down, which can cause traffic disruption to connected hosts. | 3.7.7-3.7.10 |
| 2545607 |
The protocol daemon bgpd crashes when a link/neighbor flaps if static routes pointing to Null0 are advertising through BGP.To work around this issue, reboot the switch, then remove the static routes or stop advertising these routes. |
3.7.9-3.7.10, 4.0.0-4.0.1 |
| 2545520 |
The length of the netlink message is not set properly for non-bridge family type messages. The same length is used for both bridge and non-bridge even though the bridge family type message has an extra attribute. This causes extra bytes to be left over in non-bridge family type netlink messages. | 3.7.10, 4.0.0-4.4.5 |
| 2545505 |
If you change multiple BGP or BFD timers in the /etc/frr/frr.conf file and then reload FRR, a traceback is encountered and the change does not take effect. |
3.7.9-3.7.10 |
| 2545447 |
The l1-show command prints a traceback for switch ports that have sub-interfaces configured. There is no functional impact to traffic but the l1-show troubleshooting and validation command does not execute on switch ports that have VLAN sub-interfaces. |
3.7.10, 4.0.0-4.0.1 |
| 2545405 |
The ospfd daemon might crash with the following kernel trace:
|
3.7.6-3.7.10 |
| 2545235 |
On the Edgecore AS6812 switch, you might see rare I2C errors. | 3.7.2-3.7.10, 4.0.0-4.0.1 |
| 2545193 |
switchd does not program multicast routes 224/8 into hardware. |
3.7.9-3.7.10 |
| 2545132 |
On the Mellanox switch, ACL lookups are performed for VLAN matches when no rules with UNTAGGED match are present. |
3.7.2-3.7.10, 4.0.0-4.0.1 |
| 2545086 |
On the Mellanox switch with the Spectrum ASIC, the –set-burst parameter in an iptables rule does not take effect. |
3.7.10, 4.0.0-4.0.1 |
| 2545048 |
When networking fails to start properly, an MLAG memory leak occurs, which might cause memory issues. | 3.7.9-3.7.10, 4.0.0-4.0.1 |
| 2545027 |
In the default VRF, VRRP might crash and stay in an initialize state. As a result, VRRP multicast traffic is not generated. | 3.7.8-3.7.10 |
| 2544846 |
You might experience a bgpd memory usage increase and significant update exchanges due to host moves between VTEPs. |
3.7.7-3.7.10, 4.0.0-4.0.1 |
| 2544815 |
If a router MAC address changes on a VTEP, other VTEPs might still point to the previous router MAC address. | 3.7.10 |
| 2544723 |
Setting ProtoDown on ports populated with SFP modules providing RJ-45 1000BASE-T interfaces does not cause the carrier to be dropped. The kernel shows carrier down; however, the remote device still shows a link. | 3.7.6-3.7.10, 4.0.0-4.4.5 |
| 2544624 |
VXLAN encapsulated ICMP packets hit the catchall EFP policer instead of the ICMP policer and you might experience partial packet loss. |
3.7.9-3.7.10, 4.0.0-4.0.1 |
| 2544609 |
BGP is configured with soft reconfiguration-in for its peers, which is not working correctly and causes routes to have an unexpected label. As a result, transit traffic is not forwarded by the switch. | 3.7.7-3.7.10 |
| 2544559 |
When you install a large number of new rules with nonatomic mode enabled, there is a chance that you install more rules than the number of available slots in the slice, which results in the slice being completely wiped and reinstalled. This causes a large drop increase, including to cpu0, and might cause a major outage by dropping all BGP sessions. | 3.7.8-3.7.10 |
| 2544385 |
The QCT QuantaMesh BMS T7032-IX7 switch may report “failed to request GPIO pin” errors during the boot up. | 3.7.5-3.7.10 |
| 2544328 |
When an MLAG peerlink frequently alternates states between learning and blocking, an excessive number of TCP sessions might be created, which results in the following error display:
|
4.0.0-4.0.1 |
| 2544212 |
Cumulus Linux poed generates excessive debug log entries. These will be reduced in a future release. | 3.7.3-3.7.10, 4.0.0-4.0.1 |
| 2544199 |
Traffic sent to the SVI IP address of a switch might be lost if all of the following conditions are met: * The switch is a member of an MLAG pair * The traffic is sourced from a layer 2 adjacent host * The host is located within a VRF of the MLAG pair * The traffic from the source crosses the peer link * VXLAN is configured on the MLAG pair This issue does not impact transit traffic or traffic that does not meet all of the described conditions. To workaround this issue, restart switchd. |
3.7.9-3.7.10, 4.0.0-4.0.1 |
| 2544182 |
NCLU crashes when you run the net add interface storage-optimized pfc command because non-ascii quotes exist in the datapath.conf file.To work around this issue, manually edit the /usr/lib/python2.7/dist-packages/cumulus/__chip_config/mlx/datapath.conf file and replace the non-ascii single quotes with ascii single quotes (standard single quote on the keyboard). |
3.7.9-3.7.10 |
| 2544057 |
FRR crashes when adding an IPv6 neighbor with extended-nexthop capability. | 3.7.9-3.7.10 |
| 2543937 |
An interface alias configured outside FRR using iproute2 is imported into the FRR running configuration and overrides the internal description. After an FRR reload, this causes FRR to delete the interface alias in an inefficient way. Depending on how many interfaces with aliases you have configured, this can cause a FRR reload to time out.To work around this issue, remove the interface alias description from iproute2. |
3.7.8-3.7.10, 4.0.0-4.4.5 |
| 2543875 |
On the Mellanox Spectrum switch, a route withdrawal might cause the associated next hop neighbor entry to be deleted in hardware but remain in the kernel. This can cause traffic going through the directly connected route to the removed neighbor entry to be forwarded to the CPU. | 3.7.6-3.7.10 |
| 2543781 |
NCLU does not allow you to configure OSPF NSSAs. For example:
To work around this issue, use FRR instead. For example:
|
3.7.7-3.7.10, 4.0.0-4.4.5 |
| 2543727 |
ACL rules, such as the following, fail to install if you use swp+ (interfaces mentioned as wildcards).
You can now install such rules with swp+. |
3.7.3-3.7.10 |
| 2543724 |
If a hostname contains utf-8 characters, the NCLU net show lldp command outputs the following error:
|
3.7.7-3.7.10, 4.0.0-4.4.5 |
| 2543708 |
Cumulus Linux does not map QinQ packets to VXLANs in a configuration with a VLAN-aware bridge and MLAG on the Trident3 platform. |
3.7.9-3.7.10 |
| 2543689 |
On the Mellanox switch, UFT profiles are unable to support the documented capacity for routes to addresses that are more than 64 bits in length. The listed capacities assume 64-bit destination IP addresses. | 3.7.8-3.7.10, 4.0.0-4.0.1 |
| 2543667 |
On the EdgeCore AS4610 switch, the ping command fails unless you run the command with sudo. To work around this issue, run the following commands:
Run the following command to verify the workaround:
You should see the following output:
|
3.7.6-3.7.10, 4.1.0-4.1.1 |
| 2543665 |
clagd memory consumption increases under certain unknown conditions. |
3.7.8-3.7.10 |
| 2543473 |
Configuring an inbound route map to manually change the next hop IP address received from an eBGP peer locally causes the next hop to not be updated when advertising this route out to other eBGP peers. To work around this issue, set a “dummy” route map outbound to the eBGP peer or configure the route map to manually set the next hop outbound from the originating eBGP peer. | 3.7.6-3.7.10 |
| 2543374 |
After a remote VTEP peer link goes down, the tunnel destination IP address might be incorrect in hardware, which might cause loss of overlay communication between VTEPs. | 3.7.8-3.7.10 |
| 2543325 |
Lenovo switches do not send or receive LLDP on eth0 interfaces. | 3.7.7-3.7.10 |
| 2543113 |
NCLU restarts FRR when attempting to remove a BGP VRF stanza. This happens regardless of whether the VRF is valid/configured elsewhere on the switch or the removal is successful. To work around this issue, remove the stanza using vtysh. |
3.7.3-3.7.10 |
| 2542958 |
When transitioning from a down state to an up state due to peerlink failure and recovery, MLAG does not start the initDelay timer before trying to bring everything back up. | 3.7.7-3.7.10 |
| 2542913 |
IF-MIB::ifHCInOctets reports significantly lower values than reported by interface counters seen elsewhere. | 3.7.6-3.7.10 |
| 2542871 |
After you issue the NCLU net del bgp vrf command and commit the change, Cumulus Linux does not remove the configuration from the /etc/frr/frr.conf file or the net show config commands. |
3.7.3-3.7.10, 4.0.0-4.0.1 |
| 2542835 |
snmpd fails because NCLU does not remove agentaddress @vrf lines when running the net add snmp-server listening-address all command. |
3.7.4-3.7.10 |
| 2542765 |
When you configure the switch to send an EAP request with the net add dot1x send-eap-request-id command, the switch ignores re-authentication attempts and does not send back an EAPol. |
3.7.6-3.7.10 |
| 2542509 |
In EVPN symmetric or centralized configurations with BGP peering over a peer link, VXLAN routed packets transiting an MLAG peer are dropped until the clagd init-delay timer expires during the bring-up sequence following a reboot.The problem is caused by a race condition when programming the anycast IP address (used to terminate VXLAN tunnels), where the hardware is programmed before the software by clagd.To work around this issue, configure the BGP path across the peer link to be less preferred. The example below uses AS path prepending and the MLAG switches are iBGP neighbors. However, other BGP configurations achieve the same result. In the /etc/frr/frr.conf file, make a new AS path access list and route map to apply BGP pre-pending of the local ASN one or more times. For example:
|
3.7.6-3.7.10, 4.0.0-4.0.1 |
| 2542384 |
When you define a trap destination using @mgmt, snmpd indicates that the network is unreachable even though the IP address is reachable in the management VRF. To work around this issue, remove @mgmt vrf references in the /etc/snmp/snmpd.conf file, stop snmpd, then start snmpd manually in the management VRF with the systemctl start snmpd@mgmt command. |
3.7.6-3.7.10 |
| 2542248 |
When you generate a cl-support file, clagd.service prints log messages similar to the following:
|
3.7.6-3.7.10 |
| 2542100 |
On the EdgeCore AS7816 switch, PCIE errors cause switchd startup to fail. |
3.7.9-3.7.10 |
| 2537536 |
When FRR restarts, snmp[err] dev/kmem: Permission denied error messages are recorded in the log file and SNMPd might crash periodically. |
3.7.5-3.7.10 |
| 2536639 |
On a Dell S4048 switch, when you set the eth0 speed to 100, either with NCLU or by editing the /etc/network/interfaces file, the igb driver crashes, which brings down eth0. To work around this issue: * If eth0 is configured in the management VRF, power cycle the switch; the eth0 configuration fails and reverts back to the default (auto-negotiation/1000). * If eth0 is configured in the default VRF and you power cycle after the crash, igb continues to crash on boot up (before getting to login prompt); power-cycle the switch, select the Advanced option in GRUB to boot to recovery mode, then modify the /etc/network/interfaces file. |
3.7.0-3.7.10 |
| 2536559 |
When deleting an interface using NCLU, if the /etc/network/interfaces alias is different than the /etc/frr/frr.conf description, the net commit command returns the following error:
Despite this error, the change is made and the description is removed from the frr.conf file. |
3.7.3-3.7.10 |
| 2536230 |
On the Broadcom switch with the Trident3 ASIC, the ECN-CE bit is set by default on transit traffic. This might result in hosts adjusting traffic behavior if they are configured for the ECN feature. In Cumulus Linux 3.7.11, the default behavior changed; the ECN-CE bit is no longer set by default on transit traffic. |
3.7.3-3.7.10, 4.0.0-4.0.1 |
| 2535209 |
The net show lldp command sometimes shows the port description in the Remote Port field. The net show interface command shows the correct value in the Remote Host field.To work around this issue, use net show interface command for LLDP output when connected to Cisco equipment. |
3.7.5-3.7.10, 4.0.0-4.4.5 |
| 2534450 |
The default BGP instance must be provisioned and always exist for proper operation of dynamic leaking of routes between VRFs. | 3.7.0-3.7.10 |
| 2534040 |
On Trident2 switches running 802.3x regular link pause, pause frames are accounted in HwIfInDiscards counters and are dropped instead of processed. | |
| 2532592 |
On the Mellanox SN-2100 switch, unicast packets are counted in multicast queue counters. | |
| 2528990 |
During a link flap test, you might occasionally see a message similar to: warning: swp6: netlink: cannot set link swp6 down: [Errno 98] Address already in use. |
3.7.6-3.7.10 |
| 2526985 |
When you try to remove a VNI from a bridge using a regex match, the VNI is added back when you run the ifreload -a command. |
3.7.10 Release Notes
Open Issues in 3.7.10
| Issue ID | Description | Affects | Fixed |
|---|---|---|---|
| 3410952 |
If MLAG is configured but disconnected from an MLAG peer for an extended period of time (days or more), there is a long delay (up to a minute per day) before traffic forwarding stabilizes after the MLAG peer connection re-establishes. | 3.7.0-4.3.1 | 4.3.2-4.4.5, 5.5.0-5.15.0 |
| 3376798 |
On Broadcom switches, Cumulus Linux does not create the hardware bridging domain for a traditional bridge with a VXLAN interface during switchd restart. The /var/log/switchd.log file includes the following exception logs shortly after switchd restarts:switchd[30158]: hal_bcm_l3.c:1617 find_egr_path_if_vxlan_overlay:vxlan overlay : nh PORT: port <#>, vlanMAC learning looks correct, but traffic does not flow as expected. |
3.7.0-4.3.1 | 4.3.2-4.4.5 |
| 3330705 |
When using TACACS+, a TACACS+ server name that returns more than one IP address, such as an IPv6 and IPv4 address, is counted many times against the limit of seven TACACS+ servers, which might cause some of the later listed servers to be ignored as over the limit. To work around this issue, you can set the prefer_ip_version configuration option (the default value is 4) to choose between an IPv4 or IPv6 address if both are present. |
3.7.0-5.3.1 | 5.4.0-5.15.0 |
| 3327477 |
If you use su to change to a user specified through TACACS+, the user becomes the local tacacs0 thru tacacs15 user instead of the named user to run sudo commands. As a result, the named user password might not match the local tacacs0 thru tacacs15 user password. |
3.7.0-3.7.16, 4.0.0-4.4.5, 5.0.0-5.15.0 | |
| 3216921 |
RADIUS authenticated users with read-only access to NCLU commands (users in the users_with_show list) can run edit commands if a username for a non-local account is on the users_with_edit line of the /etc/netd.conf file. To work around this issue, make sure that all usernames on the users_with_edit line of the /etc/netd.conf file are configured local users for the system (real Linux users) |
3.7.0-3.7.16, 4.3.0-4.4.5 | |
| 3209699 |
RADIUS authenticated users with read-only access to NCLU commands (users in the users_with_show list) can run edit commands if a username for a non-local account is on the users_with_edit line of the /etc/netd.conf file. To work around this issue, make sure that all usernames on the users_with_edit line of the /etc/netd.conf file are configured local users for the system (real Linux users) |
3.7.0-4.3.0, 4.4.0-5.2.1 | 4.3.1, 5.3.0-5.15.0 |
| 3017190 |
When you power cycle the switch, multiple interfaces came up in a PoE disabled state To work around this issue, run the sudo poectl -a | grep disabled command to find ports with disabled POE. Run the sudo poectl -e swp1-swp48 command to enable POE on affected ports. |
3.7.10-3.7.16 | |
| 2660582 |
In an MLAG configuration, the secondary MLAG switch does not use a unique address instead of the MLAG system MAC address when there is a double failure (backup IP and peer link failure) To recover restart the clagd service with sudo systemctl restart clagd.service |
3.7.8-3.7.15 | 3.7.16 |
| 2653400 |
When 802.1x MAB and a parking VLAN are configured on an interface, hostapd might install a static fdb entry if the interface is down. To work around this issue, delete 802.1x from the interface with the net del interface command, then add back the 802.1x configuration. |
3.7.10-3.7.16 | |
| 2645846 |
When 802.1x MAB and a parking VLAN are configured on an interface, hostapd might install a static fdb entry if the interface is down. To work around this issue, delete 802.1x from the interface with the net del interface command, then add back the 802.1x configuration. |
3.7.10-3.7.15 | 3.7.16, 4.3.1-4.4.5 |
| 2633245 |
On the Dell N3048EP-ON switch, the SPF+ ports remain down after a power cycle. | 3.7.10-3.7.16 | |
| 2595889 |
In a traditional bridge configuration with ip-forward off, neighbors are synchronized to hardware with a switchd restart but are cleared when you flap the bridge interface. |
3.7.10-4.2.1 | 4.3.0-4.4.5 |
| 2562511 |
hostapd does not fail over to secondary RADIUS servers for 802.1x authentication when the primary radius is reachable but not responding to Access-RequestsIf the primary RADIUS server is having a problem servicing requests, you can remove it from the configuration temporarily to force requests to be sent to alternate servers. |
3.7.10-3.7.14.2 | 3.7.15-3.7.16 |
| 2556233 |
Some ECMP next-hops might fail installation into hardware at high ECMP group and route scale. The following log message will be observed when this condition occurs:WARN xx routes reverted to non-ECMP due to NH table capacity |
3.7.9-3.7.14.2 | 3.7.15-3.7.16 |
| 2556037 |
After you add an interface to the bridge, an OSPF session flap might occur |
3.7.9-4.2.0 | 4.2.1-4.4.5 |
| 2556019 |
After you add an interface to a bridge using the NCLU net add bridge bridge ports command, the bridge can go down and its MAC address changesTo work around this issue, use Linux commands to add an interface to a bridge. |
3.7.9-3.7.13 | 3.7.14-3.7.16 |
| 2553887 |
When using TACACS+ configured with a DEFAULT user providing privilege level lower than 16, TACACS+ configured users with privilege level 16 access might not be able to run privilege level 16 NCLU commands, such as net add and net del and see an error similar to the following:
To work around this issue, remove the DEFAULT user from the TACACS+ server. |
3.7.7-3.7.16, 4.0.0-4.4.5 | |
| 2553530 |
In an MLAG configuration with a layer 3 VNI, when you bounce the peer link, all layer 2 VNIs listed under the layer 3 VNI are duplicated. To work around this issue, restart FRR with the sudo systemctl restart frr.service command. |
3.7.10-4.2.1 | 4.3.0-4.4.5 |
| 2553015 |
If a neighbour contains a special character in PortID for LLDP, the net show interface command does not display the LLDP information or the command might fail. |
3.7.10-3.7.16, 4.2.0-4.4.5 | |
| 2552739 |
Counters for IPROUTER rules do not increase when traffic is forwarded to the CPU because there is no IP neighbor. | 3.7.2-3.7.16 | |
| 2552647 |
When you add a member to a bond that has a subinterface configured (such as peerlink.4094), the new member is assigned only the VLAN of the subinterface for forwarding. To work around this issue, bounce the bond or shutdown the new interface and use the remaining members over the bond. |
3.7.10-4.2.0 | 4.2.1-4.4.5 |
| 2552528 |
Ingress SPAN/ERSPAN does not mirror packets when the next hop is EVPN encapsulated. | 3.7.7-4.2.1 | 4.3.0-4.4.5 |
| 2551675 |
When you restart clagd, the edge port setting on the peer link changes. |
3.7.2-4.2.0 | 4.2.1-4.4.5 |
| 2551288 |
When you remove BFD configuration by editing the /etc/frr/frr.conf file and restarting FRR, you see a traceback.To work around this issue, either use NCLU or vtysh commands to remove the BFD configuration, or restart FRR with the new /etc/frr/frr.conf file. |
3.7.7-3.7.16 | 4.0.0-4.4.5 |
| 2550600 |
The received PVST BPDU for a VLAN is flooded even though the ingress port doesn’t have the VLAN tagged. | 3.7.8-3.7.14.2, 4.0.0-4.3.0 | 3.7.15-3.7.16, 4.3.1-4.4.5, 4.4.0-4.4.5 |
| 2550478 |
VXLAN interface as in-interface or out-interface in an ACL is not supported in Spectrum-based switches. | 3.7.7-4.2.0 | 4.2.1-4.4.5, 4.3.0-4.4.5 |
| 2550375 |
CPU utilization may increase when clag-managed bond interfaces are operationally/LACP down but the physical carrier remains up on the bond member switchports. This condition occurs when clag bond redirection is enabled and bond members remain up while the parent bond does not negotiate LACP. This issue is resolved in Cumulus Linux 3.7.14. |
3.7.9-4.2.1 | 4.3.0-4.4.5 |
| 2550350 |
Unicast traffic from downlink hosts is flooded to multiple remote VTEPs, which might also cause high HwIfOutQDrops/TX_DRP on the uplink ports. To work around this issue, restart switchd. |
3.7.10-4.1.1 | 4.2.0-4.4.5 |
| 2550323 |
After a neighbor is removed, the redistributed neighbor entry is withdrawn from the BGP table, but the prefix might still be selected as the bestpath when the host’s originated prefix is not advertised. To work around this issue, recreate the neighbor entry and flap the interface to the host. Or, if the host is already down, manually create a neighbor entry with an invalid MAC address, which forces redistribute neighbor to re-withdraw the entry. |
3.7.3-3.7.16 | 4.0.0-4.4.5 |
| 2549676 |
After you add or remove a bridge VLAN identifier (VID) on a trunk port, the layer 2 VNI is put into VLAN 1. To work around this issue, revert the configuration change. |
3.7.10-3.7.12, 4.0.0-4.1.1 | 3.7.13-3.7.16, 4.2.0-4.4.5 |
| 2548585 |
After you flap an MLAG peerlink, a rare condition might occur where routes and neighbors for VXLAN-enabled VLANs are misprogrammed as non-VXLAN routes and neighbors due to VNI state transitions. This results in a forwarding failure for traffic destined to these misprogrammed routes and neighbors. Note: Do not flap a VNI interface manually. The only expected time for a VNI interface to go down is when the MLAG secondary switch brings the VNIs protodown during a peer link failure where the backup IP address is still active. To recover from this condition, restart switchd with the sudo systemctl restart switchd command. |
3.7.10-3.7.12, 4.1.0-4.1.1 | 3.7.13-3.7.16, 4.2.0-4.4.5 |
| 2548475 |
After you add a new VNI and a layer 3 SVI to a set of leafs, certain leafs might not be able to communicate on the layer 3 VNI. To work around this issue, reboot the leaf switch or restart switchd. |
3.7.6-3.7.16 | 4.0.0-4.4.5 |
| 2548382 |
The QuantaMesh BMS T3048-LY8 switch shows a low fan RPM in syslog. | 3.7.5-3.7.12, 4.0.0-4.1.1 | 3.7.13-3.7.16, 4.2.0-4.4.5 |
| 2548243 |
On switches with the Trident2+ ASIC, adding SPAN rules disables PBR rules. | 3.7.3-3.7.16, 4.0.0-4.4.5 | |
| 2548155 |
The net show bgp neighbor swpX json command shows negative output for the bgpTimerUpMsec timer. |
3.7.10-3.7.16 | 4.0.0-4.4.5 |
| 2548111 |
When you remove, then re-add an NSX VTEP binding, the VXLAN VTEP interface is not recreated. | 3.7.9-4.0.1 | 4.1.0-4.4.5 |
| 2547769 |
syslog might report a high load average with the CPU running a later microcode revision. |
3.7.4-3.7.12 | 3.7.13-3.7.16 |
| 2547663 |
When traffic from a double tag interface (facing a different site) is forwarded through VXLAN, the inner tag is not removed. The destination does not know this tag, so it discards it. | 3.7.8-4.0.1 | 4.1.0-4.4.5 |
| 2547573 |
On Tomahawk switches, when the vxlan_tnl_arp_punt_disable option is set to FALSE, ARP packets are not forwarded to the CPU. |
3.7.9-3.7.16 | |
| 2547508 |
When a Trident3 switch receives packets containing an IP checksum value that is not compliant with RFC 1624, the TTL is decremented after a routing operation but the checksum is not recalculated. This results in the IP checksum value being invalid as the packet leaves the switch. | 3.7.10-3.7.11, 4.0.0-4.0.1 | 3.7.12-3.7.16, 4.1.0-4.4.5 |
| 2547293 |
On the Broadcom Trident3 switch with DHCP relay, where the DHCP server is reachable through the EVPN overlay, DHCP discover packets forwarded to the CPU might appear corrupt and might not get forwarded. | 3.7.9-4.0.1 | 4.1.0-4.4.5 |
| 2547246 |
The MLAG switch pair has VLANs defined that are not used on MLAG bonds. These VLANs still synchronize MAC addresses across to the peer switch. This results in log messages that indicate a MAC address is installed and the VLAN is not defined; for example:
|
3.7.10-4.1.1 | 4.2.0-4.4.5 |
| 2547121 |
An unhandled exception might occur after you run the sudo poectl -i command. In addition, random poed daemon restarts can occur without any unhandled exceptions but with an invalid response length error. Both issues can occur due to a SerialException.To work around this issue, power cycle the switch. A software reboot does not resolve the issue. |
3.7.10-3.7.11 | 3.7.12-3.7.16, 4.1.0-4.4.5 |
| 2547068 |
Hardware platforms using the Intel D-1500 CPU series might reboot unexpectedly To work around this issue, contact your hardware vendor to inquire if a new version of BIOS with a microcode fix is available or manually disable CPU C-states in the kernel as outlined below To permanently disable C-states using a kernel boot parameter:1. Edit /etc/default/grub to add the argument processor.max_cstate=0 to the variable GRUB_CMDLINE_LINUX. For example, if /etc/default/grub file contains the line GRUB_CMDLINE_LINUX=“cl_platform=accton_as7726_32x console=tty0 console=ttyS0,115200n8 intel_iommu=off pcie_aspm=off”, change it to GRUB_CMDLINE_LINUX=“cl_platform=accton_as7726_32x console=tty0 console=ttyS0,115200n8 intel_iommu=off pcie_aspm=off processor.max_cstate=0”2. Run sudo update-grub3. Reboot the system with sudo rebootTo disable cstates in realtime on the current system, which does not persist through a reboot:1. Confirm that the libpci3 package is installed. Run dpkg-query -l libpci3 and confirm the following line is displayed:ii libpci3:amd64 1:3.2.1-3 amd64 Linux PCI Utilities (shared library)The first field above should read ii. If not, install the libpci3 package by running sudo apt upgrade;sudo apt install libpci32. Disable C-states by running the command ./cpupower idle-set -d 2C-states are disabled by default in Cumulus Linux 4.3.0 and later. |
3.7.9-4.2.1 | 4.3.0-4.4.5 |
| 2547012 |
On the Mellanox Spectrum switch, switchd can sometimes fail when PBR rules are installed or removed from hardware if the rule is setting a next hop learned via a routing protocol. |
3.7.7-3.7.11, 4.0.0-4.0.1 | 3.7.12-3.7.16, 4.1.0-4.4.5 |
| 2546998 |
When you configure Cumulus Linux with a /32 address on a switch port with a configured peer address (for example, to connect to a device using IP unnumbered), the switch sends GARPs for the peer address. | 3.7.5-3.7.11 | 3.7.12-3.7.16, 4.1.0-4.4.5 |
| 2546984 |
On the EdgeCore AS7326-56X switch, the PSU fans show constant LOW warnings. | 3.7.10-3.7.12, 4.0.0-4.2.0 | 3.7.13-3.7.16, 4.2.1-4.4.5 |
| 2546950 |
switchd crashes when dynamic VRF route leaking is enabled and the following is true:* The default route is leaked from VRF1 to VRF2 * Hardware-based dynamic VRF route leaking is configured ( vrf_route_leak_enable_dynamic is set to TRUE in the /etc/cumulus/switchd.conf file). You might see logs similar to the following in /var/log/syslog:
To work around this issue, use a route map to filter the default route (the source VRF is imported into the destination VRF). |
3.7.10-3.7.12, 4.0.0-4.1.1 | 3.7.13-3.7.16, 4.2.0-4.4.5 |
| 2546868 |
Broadcom Field Alert - SID - MMU 2B Errors A few of the MMU memories on Broadcom switches are grouped together with single parity control. During SER correction when a parity error occurs on one of those groups, other memory in that group might also report a SER error. This occurs when the memory is accessed either by a packet hit or through a schan operation. This issue can cause SER errors in other memory and cause traffic mis-forwarding or a packet drop. |
3.7.0-3.7.11, 4.0.0-4.0.1 | 3.7.12-3.7.16, 4.1.0-4.4.5 |
| 2546702 |
The FRR cl-support module times out on switches on the ARM platform even when the switch is not under heavy load. To work around this issue, run the cl-support -M command to disable timeouts. |
3.7.0-3.7.11, 4.0.0-4.0.1 | 3.7.12-3.7.16, 4.1.0-4.4.5 |
| 2546577 |
A traditional bridge with QinQ and a VNI does not work for tagged traffic. | 3.7.10-4.0.1 | 4.1.0-4.4.5 |
| 2546564 |
You might see a switchd memory leak during ECMP group expansion or consolidation. |
3.7.10-3.7.11 | 3.7.12-3.7.16 |
| 2546501 |
On the EdgeCore AS7326-56X switch, eth0 and swp1 use the same MAC address. | 3.7.9-3.7.11, 4.0.0-4.0.1 | 3.7.12-3.7.16, 4.1.0-4.4.5 |
| 2546385 |
SNMP ifLastChange reports link transitions when there are none. | 3.7.6-3.7.16 | |
| 2546328 |
A memory leak in switchd might occur, which causes switchd to restart. |
3.7.10-3.7.11, 4.0.0-4.0.1 | 3.7.12-3.7.16, 4.1.0-4.4.5 |
| 2546264 |
Ifupdown2 does not set up the front panel interface for the dhclient to accept the DHCP OFFER.To work around this issue, restart the networking service after ifreload -a with the systemctl restart networking command. |
3.7.10-3.7.11, 4.0.0-4.0.1 | 3.7.12-3.7.16, 4.1.0-4.4.5 |
| 2546010 |
When hal.bcm.per_vlan_router_mac_lookup is set to TRUE in the /etc/cumulus/switchd.conf file, inter-VLAN traffic is forwarded to the CPU when associated VNI interfaces exist. |
3.7.10-3.7.16 | |
| 2545997 |
The NCLU command net show interface produces an error if bonds with no members exist.To work around this issue, remove the empty Bond interfaces from the /etc/network/interfaces file and run sudo ifreload -a. |
3.7.10-3.7.16 | |
| 2545971 |
The ports.conf file on the Dell S5248F-ON switch does not show port ganging or breakout options. |
3.7.10-3.7.11 | 3.7.12-3.7.16, 4.1.0-4.4.5 |
| 2545867 |
If you delete, then re-add a PBR policy on an interface, the configured PBR policy is not programmed in the kernel or switchd. |
3.7.9-3.7.10, 4.0.0-4.0.1 | 3.7.11-3.7.16, 4.1.0-4.4.5 |
| 2545865 |
After making a series of PBR configuration changes using NCLU commands, the stale PBR entry is still present in the kernel. | 3.7.9-3.7.10, 4.0.0-4.0.1 | 3.7.11-3.7.16, 4.1.0-4.4.5 |
| 2545837 |
If you use the NCLU commands to configure NTP and run the net add time ntp source command before you run the net add time ntp server command, the /etc/ntp.conf file is misconfigured.To work around this issue, run the net add time ntp server command before you run the net add time ntp source command. |
3.7.10-3.7.11, 4.0.0-4.4.5 | 3.7.12-3.7.16 |
| 2545699 |
On the Celestica Pebble switch, if you use IPv6 routes with mask /65 to /127, the switchd log fills with errors. |
3.7.10-4.0.1 | 4.1.0-4.4.5 |
| 2545693 |
On rare occasions, after rebooting the MLAG secondary switch, one MLAG device might see the peer as down, which can cause traffic disruption to connected hosts. | 3.7.7-3.7.10 | 3.7.11-3.7.16, 4.1.0-4.4.5 |
| 2545607 |
The protocol daemon bgpd crashes when a link/neighbor flaps if static routes pointing to Null0 are advertising through BGP.To work around this issue, reboot the switch, then remove the static routes or stop advertising these routes. |
3.7.9-3.7.10, 4.0.0-4.0.1 | 3.7.11-3.7.16, 4.1.0-4.4.5 |
| 2545599 |
IPv6 table rules might affect forwarding. For example, if you create the following rule in the /etc/cumulus/acl/policy.d/03-sshd.rules file, the rule counter increments but IPv4 SSH traffic might be dropped.
|
3.7.2-3.7.11, 4.0.0-4.0.1 | 3.7.12-3.7.16, 4.1.0-4.4.5 |
| 2545520 |
The length of the netlink message is not set properly for non-bridge family type messages. The same length is used for both bridge and non-bridge even though the bridge family type message has an extra attribute. This causes extra bytes to be left over in non-bridge family type netlink messages. | 3.7.10, 4.0.0-4.4.5 | 3.7.11-3.7.16 |
| 2545505 |
If you change multiple BGP or BFD timers in the /etc/frr/frr.conf file and then reload FRR, a traceback is encountered and the change does not take effect. |
3.7.9-3.7.10 | 3.7.11-3.7.16 |
| 2545447 |
The l1-show command prints a traceback for switch ports that have sub-interfaces configured. There is no functional impact to traffic but the l1-show troubleshooting and validation command does not execute on switch ports that have VLAN sub-interfaces. |
3.7.10, 4.0.0-4.0.1 | 3.7.11-3.7.16, 4.1.0-4.4.5 |
| 2545446 |
If you use NCLU commands to add a non-MLAG bond, then add an MLAG configuration, the net commit command fails. However, a subsequent net commit command succeeds. |
3.7.10-3.7.16 | |
| 2545405 |
The ospfd daemon might crash with the following kernel trace:
|
3.7.6-3.7.10 | 3.7.11-3.7.16 |
| 2545404 |
On the Trident3 switch, unicast ARP packets received on a VNI and forwarded to the CPU are not policed. | 3.7.10-4.0.1 | 4.1.0-4.4.5 |
| 2545316 |
When an interface flap occurs, numbered IPv6 BGP sessions might fail to establish. To work around this issue, run the ip -6 route flush cache command to flush the IPv6 route cache. |
3.7.9-3.7.11 | 3.7.12-3.7.16 |
| 2545235 |
On the Edgecore AS6812 switch, you might see rare I2C errors. | 3.7.2-3.7.10, 4.0.0-4.0.1 | 3.7.11-3.7.16, 4.1.0-4.4.5 |
| 2545193 |
switchd does not program multicast routes 224/8 into hardware. |
3.7.9-3.7.16 | 4.0.0-4.4.5 |
| 2545132 |
On the Mellanox switch, ACL lookups are performed for VLAN matches when no rules with UNTAGGED match are present. |
3.7.2-3.7.10, 4.0.0-4.0.1 | 3.7.11-3.7.16, 4.1.0-4.4.5 |
| 2545125 |
If you configure more than one VRR interface on an SVI interface, deleting one of the VRR addresses does not remove the interface/address. | 3.7.10-3.7.16, 4.0.0-4.4.5 | |
| 2545086 |
On the Mellanox switch with the Spectrum ASIC, the –set-burst parameter in an iptables rule does not take effect. |
3.7.10, 4.0.0-4.0.1 | 3.7.11-3.7.16, 4.1.0-4.4.5 |
| 2545048 |
When networking fails to start properly, an MLAG memory leak occurs, which might cause memory issues. | 3.7.9-3.7.10, 4.0.0-4.0.1 | 3.7.11-3.7.16, 4.1.0-4.4.5 |
| 2545027 |
In the default VRF, VRRP might crash and stay in an initialize state. As a result, VRRP multicast traffic is not generated. | 3.7.8-3.7.10 | 3.7.11-3.7.16 |
| 2544978 |
If you delete an undefined bond, then add a bond slave, the net commit command fails. |
3.7.9-3.7.16, 4.0.0-4.4.5 | |
| 2544968 |
FRR configuration commands for an SVI interface might have the \n misplaced in the output. For example:
should be:
To work around this issue, configure the interface manually in the /etc/frr/frr.conf file. |
3.7.9-3.7.16, 4.0.0-4.4.5 | |
| 2544953 |
When you update the hostname of a switch with the NCLU net add hostname command, then run net commit, the lldpd service does not restart and other devices still see the old hostname.To work around this issue, run the sudo systemctl restart lldpd.service command. |
3.7.10-3.7.16, 4.0.0-4.4.5 | |
| 2544937 |
The neighmgrd service does not ignore neighbors on reserved devices (lo and management devices). This issue is not seen when management VRF is enabled. |
3.7.8-3.7.11 | 3.7.12-3.7.16 |
| 2544904 |
After you delete an IPv6 numbered BGP peer group neighbor, Cumulus Linux might continue to send route advertisements. To work around this issue, restart FRR after removing the IPv6 numbered configuration. |
3.7.9-4.1.1 | 4.2.0-4.4.5 |
| 2544846 |
You might experience a bgpd memory usage increase and significant update exchanges due to host moves between VTEPs. |
3.7.7-3.7.10, 4.0.0-4.0.1 | 3.7.11-3.7.16, 4.1.0-4.4.5 |
| 2544829 |
Frames received with a VLAN tag of 0 on an interface configured as a bridge port and forwarded to the CPU for processing might appear tagged with the native VLAN when viewed with tcpdump. |
3.7.8-3.7.16 | |
| 2544815 |
If a router MAC address changes on a VTEP, other VTEPs might still point to the previous router MAC address. | 3.7.10-3.7.16 | 4.0.0-4.4.5 |
| 2544723 |
Setting ProtoDown on ports populated with SFP modules providing RJ-45 1000BASE-T interfaces does not cause the carrier to be dropped. The kernel shows carrier down; however, the remote device still shows a link. | 3.7.6-3.7.10, 4.0.0-4.4.5 | 3.7.11-3.7.16 |
| 2544624 |
VXLAN encapsulated ICMP packets hit the catchall EFP policer instead of the ICMP policer and you might experience partial packet loss. |
3.7.9-3.7.10, 4.0.0-4.0.1 | 3.7.11-3.7.16, 4.1.0-4.4.5 |
| 2544609 |
BGP is configured with soft reconfiguration-in for its peers, which is not working correctly and causes routes to have an unexpected label. As a result, transit traffic is not forwarded by the switch. | 3.7.7-3.7.16 | 4.0.0-4.4.5 |
| 2544559 |
When you install a large number of new rules with nonatomic mode enabled, there is a chance that you install more rules than the number of available slots in the slice, which results in the slice being completely wiped and reinstalled. This causes a large drop increase, including to cpu0, and might cause a major outage by dropping all BGP sessions. | 3.7.8-3.7.16 | 4.0.0-4.4.5 |
| 2544556 |
If you reconfigure an NTP server with NCLU using different trailing options after the IP address (such as iburst), an invalid configuration is added to the /etc/ntp.conf file. For example:
If you need to alter existing server configurations, first remove the server, commit, then re-add the server with any trailing options. |
3.7.9-4.1.1 | 4.2.0-4.4.5 |
| 2544463 |
Auto-negotiation does not work with the QSFP28 cables and a remote system operating at 10G. Attempting to enable auto-negotiation with ethtool -s swp<#> autoneg on returns Operation not supported.To work around this issue, do not use auto-negotiation and set the local port speed to 10G. |
3.7.9-3.7.16, 4.0.0-4.4.5 | |
| 2544456 |
The NCLU net show lldp command displays the speed of a ganged port group as the speed of one of the individual links, rather than the sum of their speeds. |
3.7.9-3.7.16, 4.0.0-4.4.5 | |
| 2544385 |
The QCT QuantaMesh BMS T7032-IX7 switch may report “failed to request GPIO pin” errors during the boot up. | 3.7.5-3.7.10 | 3.7.11-3.7.16 |
| 2544311 |
Applying a policy-based routing (PBR) rule for all traffic from a host might disrupt ARP refresh for that connected host. | 3.7.5-3.7.16, 4.0.0-4.4.5 | |
| 2544212 |
Cumulus Linux poed generates excessive debug log entries. These will be reduced in a future release. | 3.7.3-3.7.10, 4.0.0-4.0.1 | 3.7.11-3.7.16, 4.1.0-4.4.5 |
| 2544199 |
Traffic sent to the SVI IP address of a switch might be lost if all of the following conditions are met: * The switch is a member of an MLAG pair * The traffic is sourced from a layer 2 adjacent host * The host is located within a VRF of the MLAG pair * The traffic from the source crosses the peer link * VXLAN is configured on the MLAG pair This issue does not impact transit traffic or traffic that does not meet all of the described conditions. To workaround this issue, restart switchd. |
3.7.9-3.7.10, 4.0.0-4.0.1 | 3.7.11-3.7.16, 4.1.0-4.4.5 |
| 2544182 |
NCLU crashes when you run the net add interface storage-optimized pfc command because non-ascii quotes exist in the datapath.conf file.To work around this issue, manually edit the /usr/lib/python2.7/dist-packages/cumulus/__chip_config/mlx/datapath.conf file and replace the non-ascii single quotes with ascii single quotes (standard single quote on the keyboard). |
3.7.9-3.7.10 | 3.7.11-3.7.16 |
| 2544155 |
NCLU requires you to specify an interface with multiple address-virtual statements in ascending MAC address order. |
3.7.5-3.7.16, 4.0.0-4.4.5 | |
| 2544113 |
Mac learning is not disabled by default on a double tagged peer link interface resulting in the MAC address changing between the MLAG bond and the peer link. To work around this issue, disable MAC learning on QinQ VLANs by adding bridge-learning off to the VLAN stanza in the etc/network/interfaces file. |
3.7.9-3.7.16, 4.0.0-4.4.5 | |
| 2544057 |
FRR crashes when adding an IPv6 neighbor with extended-nexthop capability. | 3.7.9-3.7.10 | 3.7.11-3.7.16 |
| 2544012 |
After you remove a subinterface, the BGP session stays in a Connect state. | 3.7.8-3.7.11 | 3.7.12-3.7.16 |
| 2543937 |
An interface alias configured outside FRR using iproute2 is imported into the FRR running configuration and overrides the internal description. After an FRR reload, this causes FRR to delete the interface alias in an inefficient way. Depending on how many interfaces with aliases you have configured, this can cause a FRR reload to time out.To work around this issue, remove the interface alias description from iproute2. |
3.7.8-3.7.10, 4.0.0-4.4.5 | 3.7.11-3.7.16 |
| 2543900 |
On the Mellanox switch, static VXLAN tunnels incorrectly allow traffic from any remote tunnel IP address. | 3.7.8-3.7.16, 4.0.0-4.4.5 | |
| 2543875 |
On the Mellanox Spectrum switch, a route withdrawal might cause the associated next hop neighbor entry to be deleted in hardware but remain in the kernel. This can cause traffic going through the directly connected route to the removed neighbor entry to be forwarded to the CPU. | 3.7.6-3.7.16 | 4.0.0-4.4.5 |
| 2543841 |
The net show evpn vni detail json command includes an extra empty dictionary at the end of the output. |
3.7.8-3.7.16, 4.0.0-4.4.5 | |
| 2543840 |
On the Mellanox SN2700 switch, you cannot enable resilient hashing (RASH) and set the bucket size to 64 in the traffic.conf file. |
3.7.6-3.7.16 | |
| 2543816 |
On the Dell S5248F-ON switch, smond might generate syslog messages indicating that the fan input RPM is lower than the normal low speed of 2500 RPM. Speeds as low as 1700 RPM are acceptable in normal thermal environments; therefore, you can ignore these messages. |
3.7.6-3.7.11, 4.0.0-4.4.5 | 3.7.12-3.7.16 |
| 2543800 |
When local-tunnelip is an SVI, the static VXLAN tunnel does not work; the next hop router receives the packet but drops it as it does not know where to forward the packet. The static VXLAN tunnel does works if local-tunnelip is a loopback or a physical layer 3 interface. |
3.7.8-3.7.16 | 4.0.0-4.4.5 |
| 2543792 |
On the EdgeCore AS5712, AS6712, AS5812 and AS6812 switch, support for multiple PSU types results in log messages similar to the following:
|
3.7.9-4.0.1 | 4.1.0-4.4.5 |
| 2543781 |
NCLU does not allow you to configure OSPF NSSAs. For example:
To work around this issue, use FRR instead. For example:
|
3.7.7-3.7.10, 4.0.0-4.4.5 | 3.7.11-3.7.16 |
| 2543727 |
ACL rules, such as the following, fail to install if you use swp+ (interfaces mentioned as wildcards).
You can now install such rules with swp+. |
3.7.3-3.7.16 | 4.0.0-4.4.5 |
| 2543724 |
If a hostname contains utf-8 characters, the NCLU net show lldp command outputs the following error:
|
3.7.7-3.7.10, 4.0.0-4.4.5 | 3.7.11-3.7.16 |
| 2543708 |
Cumulus Linux does not map QinQ packets to VXLANs in a configuration with a VLAN-aware bridge and MLAG on the Trident3 platform. |
3.7.9-3.7.16 | 4.0.0-4.4.5 |
| 2543689 |
On the Mellanox switch, UFT profiles are unable to support the documented capacity for routes to addresses that are more than 64 bits in length. The listed capacities assume 64-bit destination IP addresses. | 3.7.8-3.7.10, 4.0.0-4.0.1 | 3.7.11-3.7.16, 4.1.0-4.4.5 |
| 2543667 |
On the EdgeCore AS4610 switch, the ping command fails unless you run the command with sudo. To work around this issue, run the following commands:
Run the following command to verify the workaround:
You should see the following output:
|
3.7.6-3.7.10, 4.1.0-4.1.1 | 3.7.11-3.7.16, 4.2.0-4.4.5 |
| 2543665 |
clagd memory consumption increases under certain unknown conditions. |
3.7.8-3.7.16 | 4.0.0-4.4.5 |
| 2543648 |
You cannot specify a source and destination MAC address in an ERSPAN ebtables rule. For example, the following rule does not work:
|
3.7.6-3.7.12, 4.0.0-4.1.1 | 3.7.13-3.7.16, 4.2.0-4.4.5 |
| 2543647 |
ERSPAN in ebtables does not work for VNIs. For example, the following rule does not work:
|
3.7.6-4.2.1 | 4.3.0-4.4.5 |
| 2543646 |
In an ebtables rule, ERSPAN (upper case) does not work. You need to specify erspan (lower case). | 3.7.6-3.7.16, 4.0.0-4.4.5 | |
| 2543627 |
Tomahawk 40G DACs cannot disable auto-negotiation. | 3.7.7-3.7.16 | 4.0.0-4.4.5 |
| 2543473 |
Configuring an inbound route map to manually change the next hop IP address received from an eBGP peer locally causes the next hop to not be updated when advertising this route out to other eBGP peers. To work around this issue, set a “dummy” route map outbound to the eBGP peer or configure the route map to manually set the next hop outbound from the originating eBGP peer. | 3.7.6-3.7.10 | 3.7.11-3.7.16 |
| 2543472 |
On switches with the Spectrum ASIC, the underlay hashes VXLAN packets for a given overlay flow randomly. To work around this issue, configure the ECMP hash seed to the same value on the EVPN egress leaf switches. |
3.7.7-4.0.1 | 4.1.0-4.4.5 |
| 2543374 |
After a remote VTEP peer link goes down, the tunnel destination IP address might be incorrect in hardware, which might cause loss of overlay communication between VTEPs. | 3.7.8-3.7.16 | 4.0.0-4.4.5 |
| 2543325 |
Lenovo switches do not send or receive LLDP on eth0 interfaces. | 3.7.7-3.7.16 | 4.0.0-4.4.5 |
| 2543270 |
The default route injected through OSPF when you configure default-information originate always is unreliable and might age out unexpectedly.To work around this issue, rely on a different source of default route other than injection with default-information originate. |
3.7.8-4.1.1 | 4.2.0-4.4.5 |
| 2543211 |
In some cases, the switchd service might warn of excessive MAC moves from one switch port to itself (for example, from swp18 to swp18). |
3.7.0-3.7.16, 4.0.0-4.4.5 | |
| 2543164 |
The MTU of an SVI cannot be higher than the MTU on the bridge. Changing the MTU on the SVI with NCLU does not update the bridge MTU. The net commit command succeeds even though the MTU is not changed as expected.To work around this issue, change the MTU on all SVIs and the bridge manually in the /etc/network/interfaces file, then apply the change with the ifreload -a command. |
3.7.7-3.7.16, 4.0.0-4.4.5 | |
| 2543113 |
NCLU restarts FRR when attempting to remove a BGP VRF stanza. This happens regardless of whether the VRF is valid/configured elsewhere on the switch or the removal is successful. To work around this issue, remove the stanza using vtysh. |
3.7.3-3.7.16 | 4.0.0-4.4.5 |
| 2543096 |
When an SVI with a virtual MAC is configured with a layer 2 VNI in an EVPN environment, if you replace the /etc/network/interfaces file with a different file that does not have the SVI and layer 2 VNI configuration, the original virtual MAC is not populated through the EVPN route until FRR is restarted. |
3.7.6-3.7.16, 4.0.0-4.4.5 | |
| 2543058 |
The IP neighbor entry for a link-local next hop is not installed by FRR, which results in a forwarding failure for routes via that next hop. This is a rare problem that occurs with IPv4 route exchange over IPv6 GUA peering with no IPv4 addresses on the interfaces. To work around this issue, flap the peering to the peer router (which might be a route reflector) to recover. To avoid this issue, configure IPv6 router advertisements on the connecting interfaces. |
3.7.7-3.7.16 | 4.0.0-4.4.5 |
| 2543052 |
Received EVPN type-5 and type-2 MACIP routes are not installed in the kernel (and hardware) routing tables for the associated VRF, which causes traffic to be blackholed. The failure to install the default route causes complete reachability failure for the particular tenant on the affected racks. The routes that are not installed are seen as “inactive” in the routing subsystem (FRR) VRF routing table. This problem is rare and can occur only in EVPN configurations that have user-configured route targets (RTs) for tenant VRFs, and only following a restart of FRR. To work around this issue, either restart the FRR service on the affected switch with the sudo systemctl restart frr.service command or bounce the layer 3 SVI for the affected VRF; for example:
You can run the net show vrf vni command to print a mapping of VRF : L3-VNI : L3-SVI. |
3.7.5-3.7.16 | 4.0.0-4.4.5 |
| 2543044 |
Under certain conditions, EVPN next hops might not be removed when the contributing peer goes down or might not be populated when the BGP session to the contributing peer comes up. You can prevent EVPN next hops from not being removed when the contributing peer goes down by specifying static MAC addresses on all layer 3 VNIs. There is no workaround for preventing EVPN next hops from not being populated when the BGP session to the contributing peer comes up. |
3.7.2-3.7.16 | 4.0.0-4.4.5 |
| 2542979 |
On the Dell-N3048EP-ON switch, when you run the sudo -E apt upgrade command, the upgrade does not work. |
3.7.7-4.1.1 | 4.2.0-4.4.5 |
| 2542958 |
When transitioning from a down state to an up state due to peerlink failure and recovery, MLAG does not start the initDelay timer before trying to bring everything back up. | 3.7.7-3.7.16 | 4.0.0-4.4.5 |
| 2542945 |
On the Broadcom Maverick switch with a QinQ configuration, the packets coming into the CPU might be tagged incorrectly; for example, 802.1ad + 802.1q tags are expected in the packets but the packets have 802.1q + 802.1q tags. To work around this issue, configure the bridge with bridge-vlan-protocol 802.1ad:
|
3.7.6-3.7.16, 4.0.0-4.4.5 | |
| 2542913 |
IF-MIB::ifHCInOctets reports significantly lower values than reported by interface counters seen elsewhere. | 3.7.6-3.7.16 | 4.0.0-4.4.5 |
| 2542871 |
After you issue the NCLU net del bgp vrf command and commit the change, Cumulus Linux does not remove the configuration from the /etc/frr/frr.conf file or the net show config commands. |
3.7.3-3.7.10, 4.0.0-4.0.1 | 3.7.11-3.7.16, 4.1.0-4.4.5 |
| 2542835 |
snmpd fails because NCLU does not remove agentaddress @vrf lines when running the net add snmp-server listening-address all command. |
3.7.4-3.7.16 | 4.0.0-4.4.5 |
| 2542823 |
On the Broadcom Trident 3 switch, VXLAN encapsulated packets are dropped on the ingress port (tagged layer 2 port) during transit forwarding (the local switch does not terminate the VXLAN tunnel). An example of where this two-layer VXLAN inside VXLAN encapsulation might occur: - VXLAN tunnel (#1) between two servers (different racks) to provide layer 2 extension for containers or VM hosts. - VXLAN tunnel (#2) between the TOR switch in rack 1 to the TOR switch located in the remote rack. To work around this issue, either: - Configure the edge port (facing the servers) to be an access port (instead of a trunk/tagged port) - Change the destination port from 4789 to something else (VXLAN tunnel terminated by the servers) |
3.7.5-3.7.11, 4.0.0-4.0.1 | 3.7.12-3.7.16, 4.1.0-4.4.5 |
| 2542767 |
If the BMC operating system fails to respond to IPMI, you see a traceback in bmcd and all the sensors might report ABSENT devices in smonctl. To work around this issue, power cycle the switch. |
3.7.6-4.0.1 | 4.1.0-4.4.5 |
| 2542765 |
When you configure the switch to send an EAP request with the net add dot1x send-eap-request-id command, the switch ignores re-authentication attempts and does not send back an EAPol. |
3.7.6-3.7.10 | 3.7.11-3.7.16 |
| 2542509 |
In EVPN symmetric or centralized configurations with BGP peering over a peer link, VXLAN routed packets transiting an MLAG peer are dropped until the clagd init-delay timer expires during the bring-up sequence following a reboot.The problem is caused by a race condition when programming the anycast IP address (used to terminate VXLAN tunnels), where the hardware is programmed before the software by clagd.To work around this issue, configure the BGP path across the peer link to be less preferred. The example below uses AS path prepending and the MLAG switches are iBGP neighbors. However, other BGP configurations achieve the same result. In the /etc/frr/frr.conf file, make a new AS path access list and route map to apply BGP pre-pending of the local ASN one or more times. For example:
|
3.7.6-3.7.10, 4.0.0-4.0.1 | 3.7.11-3.7.16, 4.1.0-4.4.5 |
| 2542384 |
When you define a trap destination using @mgmt, snmpd indicates that the network is unreachable even though the IP address is reachable in the management VRF. To work around this issue, remove @mgmt vrf references in the /etc/snmp/snmpd.conf file, stop snmpd, then start snmpd manually in the management VRF with the systemctl start snmpd@mgmt command. |
3.7.6-3.7.16 | 4.0.0-4.4.5 |
| 2542310 |
hsflow disregards the setting for agent.cidr in the /etc/hsflowd.conf file and selects an IPv6 agent address. The source IP address of the hsflowd packet is IPv4, but the agent address in the hsflow payload shows IPv6. |
3.7.6-3.7.16 | |
| 2542305 |
If an SVI exists in the configuration before you assign it an IP address, when you do assign the IP address with the NCLU command, the vlan-id and the raw-device bridge stanzas are not added automatically. |
3.7.6-3.7.16, 4.0.0-4.4.5 | |
| 2542301 |
When first creating a bond and enslaving an interface, NCLU hides some of the bridge command suggestions, although they are still accepted. |
3.7.3-3.7.16, 4.0.0-4.4.5 | |
| 2542248 |
When you generate a cl-support file, clagd.service prints log messages similar to the following:
|
3.7.6-3.7.16 | 4.0.0-4.4.5 |
| 2542100 |
On the EdgeCore AS7816 switch, PCIE errors cause switchd startup to fail. |
3.7.9-3.7.16 | 4.0.0-4.4.5 |
| 2541212 |
The maximum-prefix configuration under the IPv4 address family has an optional restart value, which you can configure. This configuration is ignored and, instead of restarting the sessions every x minutes, the peer constantly changes between established and idle due to the prefix count being exceeded. |
3.7.5-3.7.16, 4.0.0-4.4.5 | |
| 2541165 |
On the Dell N3048EP-ON switch, UPOE is supported only on ports 1 thru 12. (UPOE uses all four pairs of standard Ethernet cabling whereas PoE delivers power over two twisted pairs.) When you plug a UPOE device in a port higher than port 12, poectl reports that four_pair_mode_enabled is true. However, this configuration is not supported on the port so poectl should report that four_pair_mode_enabled is false. |
3.7.6-3.7.16 | |
| 2541029 |
On switches with the Trident2 ASIC, 802.1Q-encapsulated control plane traffic received on an interface with 802.1AD configured subinterfaces might be dropped. This issue only affects QinQ configurations. |
3.7.5-3.7.16, 4.0.0-4.4.5 | |
| 2540950 |
On the QuantaMesh T4048-IX8 or EdgeCore AS7326-56X switch, when using a 1000BASE-T SFP module, the module LEDs do not light to reflect link status. |
3.7.3-4.1.1 | 4.2.0-4.4.5 |
| 2540885 |
The Dell N3048EP-ON switch does not support 1G Base-T modules in the SFP ports. | 3.7.7-3.7.16 | |
| 2540863 |
On the EdgeCore AS5812-54X switch, the PSU2 Fan1 fluctuates between OK and LOW. When the fan speed is reported as LOW, the RPM is shown as a negative number. |
3.7.3-3.7.16 | |
| 2540753 |
If the interface alias contains a single or double quotation mark, or an apostrophe, the net show configuration commands fail with the following error:
|
3.7.5-3.7.16, 4.0.0-4.4.5 | |
| 2540444 |
SNMP incorrectly requires engine ID specification. |
3.7.4-3.7.16, 4.0.0-4.4.5 | |
| 2540352 |
When you use NCLU to configure a route map, the parser allows for glob matching of interfaces for a match interface condition when there can only be a single interface matched. The proper syntax is to use multiple route map clauses, each matching a single interface, instead of a single clause matching multiple interfaces. For example, this command is incorrect:
These commands are correct:
|
3.7.2-3.7.16, 4.0.0-4.4.5 | |
| 2540340 |
NCLU allows for the configuration of addresses on VRF interfaces, but tab completion for the net add vrf command just displays
Tab completion for the net add vrf command works correctly. |
3.7.4-3.7.16, 4.0.0-4.4.5 | |
| 2540274 |
On the Maverick switch, CPU forwarded packets might be dropped when there is no route to a leaked host route. | 3.7.5-3.7.16, 4.0.0-4.4.5 | |
| 2540204 |
When links come up after FRR is started, VRF connected routes do not get redistributed. | 3.7.4-3.7.16, 4.0.0-4.4.5 | |
| 2540192 |
The net del bridge bridge mcsnoop yes command does not return the value to the default of disabled. To work around this issue, use the net add bridge bridge mcsnoop no command to delete the mcsnoop attribute and return to the default value. |
3.7.4-3.7.16, 4.0.0-4.4.5 | |
| 2540155 |
On the Broadcom switch, when moving configuration from bridged to routed (or toggling from routed to bridged to routed), some traffic is not seen by the kernel. This can cause BGP to not establish on a transit node. |
3.7.3-3.7.16, 4.0.0-4.4.5 | |
| 2540042 |
When you try to configure the VRRP priority and advertisement-interval with NCLU on a traditional mode bridge, the net commit command fails. To work around this issue, use the vtysh command (inside FRR) to change the VRRP priority or advertisement-interval on traditional bridges. For example:
|
3.7.4-3.7.16, 4.0.0-4.4.5 | |
| 2540041 |
On SVIs in a VLAN-aware bridge, you cannot change the VRRP priority with NCLU. To work around this issue, run the vtysh command inside FRR to change the default priority. For example:
|
3.7.4-3.7.16, 4.0.0-4.4.5 | |
| 2540040 |
Cumulus Linux uses VRRPv3 as the default version, and enables both preempt and accept mode by default. You cannot change these default values with NCLU. To work around this issue, run the vtysh commands (inside FRR) to change the default values. For example:
|
3.7.4-3.7.16, 4.0.0-4.4.5 | |
| 2540031 |
NCLU does not honor auto all in the /etc/network/interfaces file and removes the existing configuration if no individual auto lines exist. |
3.7.3-3.7.16, 4.0.0-4.4.5 | |
| 2539994 |
When you try to remove a BGP peer group configuration with NCLU, the command fails but no warning message is shown. For example:
|
3.7.2-3.7.16, 4.0.0-4.4.5 | |
| 2539962 |
When an LDAP user that does not have NCLU privileges (either in the netshow or netedit group, or in the /etc/netd.conf file) runs an NCLU command, a traceback occurs instead of a permissions error. |
3.7.0-3.7.16, 4.0.0-4.4.5 | |
| 2539670 |
On the Edgecore 4610-54P switch, automatic medium-dependent interface crossover (auto-MDIX) stops working on a 100M full duplex interface and does not detect the required cable connection type. |
3.7.2-3.7.16, 4.0.0-4.4.5 | |
| 2539124 |
The net add interface command adds no ptm-enable for that interface in the frr.conf file. Running the net add or the net del command does not remove no ptm-enable from the frr.conf file. You have to remove it manually using vtysh. |
3.7.2-3.7.16, 4.0.0-4.4.5 | |
| 2539081 |
When you delete post-up and pre-down IP peer entries from the etc/network/interfaces file, then run the ifreload command, the IP addresses are not removed and the route remains in the route table. To work around this issue, either delete the IP addresses without the /32 mask component or flush the IP addresses for the interface with the ip addr flush dev command. |
3.7.0-3.7.16 | 4.0.0-4.4.5 |
| 2538875 |
IPv6 multicast traffic destined to an unregistered multicast group is flooded to all ports in a bridge despite the bridge.optimized_mcast_flood = TRUE setting in the /etc/cumulus/swichd.conf file. |
3.7.2-3.7.16 | |
| 2538790 |
NCLU automatically adds the VLAN ID (for the layer 3 VNI/SVI) to the bridge when you run net add vxlan . This configuration breaks network connectivity in an EVPN symmetric routing configuration using MLAG. To restore connectivity, remove the VLAN ID from the bridge. |
3.7.2-3.7.16, 4.0.0-4.4.5 | |
| 2538590 |
When you configure a control plane ACL to define permit and deny rules destined to the local switch, NCLU programs the control plane ACL rules into the FORWARD chain. |
3.7.2-3.7.16, 4.0.0-4.4.5 | |
| 2538562 |
On an RMP/1G-T switch, when you remove link-speed 100 with the NCLU command or by editing the etc/network/interfaces file to revert the 100M interface to the default (1G auto), the interface fails to recover and does not come back up.After you remove the link-speed, ethtool shows the advertised link modes as not reported and Speed/Duplex as unknown.To work around this issue and bring the interface back up, either restart switchd or use ethtool to configure the speed, advertised, duplex or MDI-X settings. Note: The advertised link mode gets set incorrectly if you include 1000baseT/Half. The port will come up successfully at 1G. |
3.7.2-3.7.16, 4.0.0-4.4.5 | |
| 2538302 |
portwd allows an error to change the module type based on the error. For example, a bad write to a module might cause the module type to flap, which causes the link itself to flap. |
3.7.0-3.7.16 | |
| 2538294 |
If you use NCLU to create an iBGP peering across the peer link, running the net add bgp l2vpn evpn neighbor peerlink.4094 activate command creates a new eBGP neighborship when one has already been configured for iBGP. This is unexpected; the existing iBGP configuration is valid. |
3.7.0-3.7.16, 4.0.0-4.4.5 | |
| 2538256 |
On the Broadcom switch, when a link-local multicast frame is received on an access port with a VNI in the bridge, two copies of the packet are sent across the VNI to remote VTEPs and the receiving hosts observe duplicate packets. |
3.7.2-4.0.1 | 4.1.0-4.4.5 |
| 2537819 |
When you enable FEC (RS or BaseR) on an interface, removing the configuration from that interface does not revert the FEC status to off/none. |
3.7.2-3.7.16 | 4.0.0-4.4.5 |
| 2537699 |
There is a limitation on the number of SVI interfaces you can specify as DHCP relay interfaces in the /etc/default/isc-dhcp-relay file. For example, 1500 SVI interfaces causes the dhcrelay service to exit without a core file and logs similar to the following are generated for the interfaces:
Eventually the dhcrelay service stops. |
3.7.1-3.7.16, 4.0.0-4.4.5 | |
| 2537544 |
When you run the mstpctl command, you might see the bridge-port state as blocking when it is actually disabled. You might see the same incorrect bridge-port state when other programs or tools use the output of mstpctl; for example, SNMP output from the BRIDGE-MIB. |
3.7.1-3.7.16, 4.0.0-4.4.5 | |
| 2537536 |
When FRR restarts, snmp[err] dev/kmem: Permission denied error messages are recorded in the log file and SNMPd might crash periodically. |
3.7.5-3.7.16 | 4.0.0-4.4.5 |
| 2537378 |
NCLU SNMPv3 user configuration (add, delete, modify) does not complete. Changes are made to the /etc/snmp/snmpd.conf file but the SNMPv3 user cache file /var/lib/snmp/snmpd.conf fails to update correctly and the configuration does not reflect in operation. To work around this issue, stop snmpd, remove the cache file, then restart snmpd. |
3.7.1-3.7.16 | |
| 2537188 |
When an event in the network, such as a switchd or networking service restart, leads to an OVSDB server high availability transition, an ovs-vtepd core might occur. This core generation has no effect on the functionality of high availability when the active OVSDB server is back in the network. |
3.7.2-3.7.16 | |
| 2537104 |
When you try to stop hsflowd on the Trident II+ switch with the systemctl stop hsflowd command, the process hangs until you stop it with SIGKILL. |
3.7.1-3.7.16 | 4.0.0-4.4.5 |
| 2537061 |
The Dell S5048F-ON switch (with reverse airflow, rear to front), shows the Temp-3 sensor as absent. |
3.7.1-4.0.1 | 4.1.0-4.4.5 |
| 2536639 |
On a Dell S4048 switch, when you set the eth0 speed to 100, either with NCLU or by editing the /etc/network/interfaces file, the igb driver crashes, which brings down eth0. To work around this issue: * If eth0 is configured in the management VRF, power cycle the switch; the eth0 configuration fails and reverts back to the default (auto-negotiation/1000). * If eth0 is configured in the default VRF and you power cycle after the crash, igb continues to crash on boot up (before getting to login prompt); power-cycle the switch, select the Advanced option in GRUB to boot to recovery mode, then modify the /etc/network/interfaces file. |
3.7.0-3.7.16 | 4.0.0-4.4.5 |
| 2536608 |
Single tagged ARP requests received on a QinQ-over-VXLAN access port are dropped if ARP suppression is enabled on an unrelated VNI. |
3.7.0-3.7.16 | |
| 2536559 |
When deleting an interface using NCLU, if the /etc/network/interfaces alias is different than the /etc/frr/frr.conf description, the net commit command returns the following error:
Despite this error, the change is made and the description is removed from the frr.conf file. |
3.7.3-3.7.10 | 3.7.11-3.7.16 |
| 2536384 |
The BFD packet redirection logic used by OVSDB server high availability mode redirects BUM packets across the peer link. The iptables rule for redirection does differentiate between BFD and non-BFD VXLAN inner packets because the service node sends all frames with its own IP address as the tunnel source IP address. The VXLAN encapsulated BUM packets do not get forwarded to the CPU and do not go through the iptable redirection rule; only VXLAN encapsulated BFD packets get forwarded to the CPU due to the inner MAC DA lookup in hardware. |
3.7.0-3.7.16, 4.0.0-4.4.5 | |
| 2536230 |
On the Broadcom switch with the Trident3 ASIC, the ECN-CE bit is set by default on transit traffic. This might result in hosts adjusting traffic behavior if they are configured for the ECN feature. In Cumulus Linux 3.7.11, the default behavior changed; the ECN-CE bit is no longer set by default on transit traffic. |
3.7.3-3.7.10, 4.0.0-4.0.1 | 3.7.11-3.7.16, 4.1.0-4.4.5 |
| 2536179 |
On switches with the Trident 2+ ASIC, counters associated with VLANs and VRFs are not working. | 3.7.0-3.7.16, 4.0.0-4.4.5 | |
| 2535986 |
At a high CPU transmit traffic rate (for example, if there is unexpected CPU generated flooding or replication in software), when the ASIC packet driver cannot keep up with the transmit rate because there are no free DMA buffers, it can back pressure by suspending the switch port transmit queues. This can fill up the application socket buffers resulting in No buffer space available error messages on protocol sockets.When the driver recovers, it automatically resumes the transmit queues. In most cases these error messages are transient. In rare cases, the hardware queues might get stuck, which you can recover with a switchd restart. |
3.7.0-3.7.16, 4.0.0-4.4.5 | |
| 2535965 |
On the Trident3 switch, static PIM with IIF based on a layer 2 bridge does not work reliably. PIM Join via signaling is required for IPMC to work properly. To work around this issue, use dynamic signaling (joins) to manage IP multicast traffic. |
3.7.0-3.7.16, 4.0.0-4.4.5 | |
| 2535209 |
The net show lldp command sometimes shows the port description in the Remote Port field. The net show interface command shows the correct value in the Remote Host field.To work around this issue, use net show interface command for LLDP output when connected to Cisco equipment. |
3.7.5-3.7.10, 4.0.0-4.4.5 | 3.7.11-3.7.16 |
| 2534450 |
The default BGP instance must be provisioned and always exist for proper operation of dynamic leaking of routes between VRFs. | 3.7.0-3.7.16 | 4.0.0-4.4.5 |
| 2528990 |
During a link flap test, you might occasionally see a message similar to: warning: swp6: netlink: cannot set link swp6 down: [Errno 98] Address already in use. |
3.7.6-3.7.10 | 3.7.11-3.7.16 |
Fixed Issues in 3.7.10
| Issue ID | Description | Affects |
|---|---|---|
| 2544073 |
After upgrading to Cumulus Linux 3.7.9 on a Broadcom switch, CPU generated traffic (such as ICMP, OSPF, ARP, and so on) egresses access ports with a 802.1Q header or interfaces with a bridge-pvid, with a VLAN ID of 0. Equipment from other vendors might drop this traffic. | 3.7.9 |
3.7.9 Release Notes
Open Issues in 3.7.9
| Issue ID | Description | Affects | Fixed |
|---|---|---|---|
| 3410952 |
If MLAG is configured but disconnected from an MLAG peer for an extended period of time (days or more), there is a long delay (up to a minute per day) before traffic forwarding stabilizes after the MLAG peer connection re-establishes. | 3.7.0-4.3.1 | 4.3.2-4.4.5, 5.5.0-5.15.0 |
| 3376798 |
On Broadcom switches, Cumulus Linux does not create the hardware bridging domain for a traditional bridge with a VXLAN interface during switchd restart. The /var/log/switchd.log file includes the following exception logs shortly after switchd restarts:switchd[30158]: hal_bcm_l3.c:1617 find_egr_path_if_vxlan_overlay:vxlan overlay : nh PORT: port <#>, vlanMAC learning looks correct, but traffic does not flow as expected. |
3.7.0-4.3.1 | 4.3.2-4.4.5 |
| 3330705 |
When using TACACS+, a TACACS+ server name that returns more than one IP address, such as an IPv6 and IPv4 address, is counted many times against the limit of seven TACACS+ servers, which might cause some of the later listed servers to be ignored as over the limit. To work around this issue, you can set the prefer_ip_version configuration option (the default value is 4) to choose between an IPv4 or IPv6 address if both are present. |
3.7.0-5.3.1 | 5.4.0-5.15.0 |
| 3327477 |
If you use su to change to a user specified through TACACS+, the user becomes the local tacacs0 thru tacacs15 user instead of the named user to run sudo commands. As a result, the named user password might not match the local tacacs0 thru tacacs15 user password. |
3.7.0-3.7.16, 4.0.0-4.4.5, 5.0.0-5.15.0 | |
| 3216921 |
RADIUS authenticated users with read-only access to NCLU commands (users in the users_with_show list) can run edit commands if a username for a non-local account is on the users_with_edit line of the /etc/netd.conf file. To work around this issue, make sure that all usernames on the users_with_edit line of the /etc/netd.conf file are configured local users for the system (real Linux users) |
3.7.0-3.7.16, 4.3.0-4.4.5 | |
| 3209699 |
RADIUS authenticated users with read-only access to NCLU commands (users in the users_with_show list) can run edit commands if a username for a non-local account is on the users_with_edit line of the /etc/netd.conf file. To work around this issue, make sure that all usernames on the users_with_edit line of the /etc/netd.conf file are configured local users for the system (real Linux users) |
3.7.0-4.3.0, 4.4.0-5.2.1 | 4.3.1, 5.3.0-5.15.0 |
| 2660582 |
In an MLAG configuration, the secondary MLAG switch does not use a unique address instead of the MLAG system MAC address when there is a double failure (backup IP and peer link failure) To recover restart the clagd service with sudo systemctl restart clagd.service |
3.7.8-3.7.15 | 3.7.16 |
| 2556233 |
Some ECMP next-hops might fail installation into hardware at high ECMP group and route scale. The following log message will be observed when this condition occurs:WARN xx routes reverted to non-ECMP due to NH table capacity |
3.7.9-3.7.14.2 | 3.7.15-3.7.16 |
| 2556037 |
After you add an interface to the bridge, an OSPF session flap might occur |
3.7.9-4.2.0 | 4.2.1-4.4.5 |
| 2556019 |
After you add an interface to a bridge using the NCLU net add bridge bridge ports command, the bridge can go down and its MAC address changesTo work around this issue, use Linux commands to add an interface to a bridge. |
3.7.9-3.7.13 | 3.7.14-3.7.16 |
| 2553887 |
When using TACACS+ configured with a DEFAULT user providing privilege level lower than 16, TACACS+ configured users with privilege level 16 access might not be able to run privilege level 16 NCLU commands, such as net add and net del and see an error similar to the following:
To work around this issue, remove the DEFAULT user from the TACACS+ server. |
3.7.7-3.7.16, 4.0.0-4.4.5 | |
| 2552739 |
Counters for IPROUTER rules do not increase when traffic is forwarded to the CPU because there is no IP neighbor. | 3.7.2-3.7.16 | |
| 2552528 |
Ingress SPAN/ERSPAN does not mirror packets when the next hop is EVPN encapsulated. | 3.7.7-4.2.1 | 4.3.0-4.4.5 |
| 2551675 |
When you restart clagd, the edge port setting on the peer link changes. |
3.7.2-4.2.0 | 4.2.1-4.4.5 |
| 2551288 |
When you remove BFD configuration by editing the /etc/frr/frr.conf file and restarting FRR, you see a traceback.To work around this issue, either use NCLU or vtysh commands to remove the BFD configuration, or restart FRR with the new /etc/frr/frr.conf file. |
3.7.7-3.7.16 | 4.0.0-4.4.5 |
| 2550600 |
The received PVST BPDU for a VLAN is flooded even though the ingress port doesn’t have the VLAN tagged. | 3.7.8-3.7.14.2, 4.0.0-4.3.0 | 3.7.15-3.7.16, 4.3.1-4.4.5, 4.4.0-4.4.5 |
| 2550478 |
VXLAN interface as in-interface or out-interface in an ACL is not supported in Spectrum-based switches. | 3.7.7-4.2.0 | 4.2.1-4.4.5, 4.3.0-4.4.5 |
| 2550375 |
CPU utilization may increase when clag-managed bond interfaces are operationally/LACP down but the physical carrier remains up on the bond member switchports. This condition occurs when clag bond redirection is enabled and bond members remain up while the parent bond does not negotiate LACP. This issue is resolved in Cumulus Linux 3.7.14. |
3.7.9-4.2.1 | 4.3.0-4.4.5 |
| 2550323 |
After a neighbor is removed, the redistributed neighbor entry is withdrawn from the BGP table, but the prefix might still be selected as the bestpath when the host’s originated prefix is not advertised. To work around this issue, recreate the neighbor entry and flap the interface to the host. Or, if the host is already down, manually create a neighbor entry with an invalid MAC address, which forces redistribute neighbor to re-withdraw the entry. |
3.7.3-3.7.16 | 4.0.0-4.4.5 |
| 2548475 |
After you add a new VNI and a layer 3 SVI to a set of leafs, certain leafs might not be able to communicate on the layer 3 VNI. To work around this issue, reboot the leaf switch or restart switchd. |
3.7.6-3.7.16 | 4.0.0-4.4.5 |
| 2548382 |
The QuantaMesh BMS T3048-LY8 switch shows a low fan RPM in syslog. | 3.7.5-3.7.12, 4.0.0-4.1.1 | 3.7.13-3.7.16, 4.2.0-4.4.5 |
| 2548243 |
On switches with the Trident2+ ASIC, adding SPAN rules disables PBR rules. | 3.7.3-3.7.16, 4.0.0-4.4.5 | |
| 2548111 |
When you remove, then re-add an NSX VTEP binding, the VXLAN VTEP interface is not recreated. | 3.7.9-4.0.1 | 4.1.0-4.4.5 |
| 2547769 |
syslog might report a high load average with the CPU running a later microcode revision. |
3.7.4-3.7.12 | 3.7.13-3.7.16 |
| 2547663 |
When traffic from a double tag interface (facing a different site) is forwarded through VXLAN, the inner tag is not removed. The destination does not know this tag, so it discards it. | 3.7.8-4.0.1 | 4.1.0-4.4.5 |
| 2547573 |
On Tomahawk switches, when the vxlan_tnl_arp_punt_disable option is set to FALSE, ARP packets are not forwarded to the CPU. |
3.7.9-3.7.16 | |
| 2547293 |
On the Broadcom Trident3 switch with DHCP relay, where the DHCP server is reachable through the EVPN overlay, DHCP discover packets forwarded to the CPU might appear corrupt and might not get forwarded. | 3.7.9-4.0.1 | 4.1.0-4.4.5 |
| 2547068 |
Hardware platforms using the Intel D-1500 CPU series might reboot unexpectedly To work around this issue, contact your hardware vendor to inquire if a new version of BIOS with a microcode fix is available or manually disable CPU C-states in the kernel as outlined below To permanently disable C-states using a kernel boot parameter:1. Edit /etc/default/grub to add the argument processor.max_cstate=0 to the variable GRUB_CMDLINE_LINUX. For example, if /etc/default/grub file contains the line GRUB_CMDLINE_LINUX=“cl_platform=accton_as7726_32x console=tty0 console=ttyS0,115200n8 intel_iommu=off pcie_aspm=off”, change it to GRUB_CMDLINE_LINUX=“cl_platform=accton_as7726_32x console=tty0 console=ttyS0,115200n8 intel_iommu=off pcie_aspm=off processor.max_cstate=0”2. Run sudo update-grub3. Reboot the system with sudo rebootTo disable cstates in realtime on the current system, which does not persist through a reboot:1. Confirm that the libpci3 package is installed. Run dpkg-query -l libpci3 and confirm the following line is displayed:ii libpci3:amd64 1:3.2.1-3 amd64 Linux PCI Utilities (shared library)The first field above should read ii. If not, install the libpci3 package by running sudo apt upgrade;sudo apt install libpci32. Disable C-states by running the command ./cpupower idle-set -d 2C-states are disabled by default in Cumulus Linux 4.3.0 and later. |
3.7.9-4.2.1 | 4.3.0-4.4.5 |
| 2547012 |
On the Mellanox Spectrum switch, switchd can sometimes fail when PBR rules are installed or removed from hardware if the rule is setting a next hop learned via a routing protocol. |
3.7.7-3.7.11, 4.0.0-4.0.1 | 3.7.12-3.7.16, 4.1.0-4.4.5 |
| 2546998 |
When you configure Cumulus Linux with a /32 address on a switch port with a configured peer address (for example, to connect to a device using IP unnumbered), the switch sends GARPs for the peer address. | 3.7.5-3.7.11 | 3.7.12-3.7.16, 4.1.0-4.4.5 |
| 2546868 |
Broadcom Field Alert - SID - MMU 2B Errors A few of the MMU memories on Broadcom switches are grouped together with single parity control. During SER correction when a parity error occurs on one of those groups, other memory in that group might also report a SER error. This occurs when the memory is accessed either by a packet hit or through a schan operation. This issue can cause SER errors in other memory and cause traffic mis-forwarding or a packet drop. |
3.7.0-3.7.11, 4.0.0-4.0.1 | 3.7.12-3.7.16, 4.1.0-4.4.5 |
| 2546702 |
The FRR cl-support module times out on switches on the ARM platform even when the switch is not under heavy load. To work around this issue, run the cl-support -M command to disable timeouts. |
3.7.0-3.7.11, 4.0.0-4.0.1 | 3.7.12-3.7.16, 4.1.0-4.4.5 |
| 2546501 |
On the EdgeCore AS7326-56X switch, eth0 and swp1 use the same MAC address. | 3.7.9-3.7.11, 4.0.0-4.0.1 | 3.7.12-3.7.16, 4.1.0-4.4.5 |
| 2546385 |
SNMP ifLastChange reports link transitions when there are none. | 3.7.6-3.7.16 | |
| 2545867 |
If you delete, then re-add a PBR policy on an interface, the configured PBR policy is not programmed in the kernel or switchd. |
3.7.9-3.7.10, 4.0.0-4.0.1 | 3.7.11-3.7.16, 4.1.0-4.4.5 |
| 2545865 |
After making a series of PBR configuration changes using NCLU commands, the stale PBR entry is still present in the kernel. | 3.7.9-3.7.10, 4.0.0-4.0.1 | 3.7.11-3.7.16, 4.1.0-4.4.5 |
| 2545693 |
On rare occasions, after rebooting the MLAG secondary switch, one MLAG device might see the peer as down, which can cause traffic disruption to connected hosts. | 3.7.7-3.7.10 | 3.7.11-3.7.16, 4.1.0-4.4.5 |
| 2545607 |
The protocol daemon bgpd crashes when a link/neighbor flaps if static routes pointing to Null0 are advertising through BGP.To work around this issue, reboot the switch, then remove the static routes or stop advertising these routes. |
3.7.9-3.7.10, 4.0.0-4.0.1 | 3.7.11-3.7.16, 4.1.0-4.4.5 |
| 2545599 |
IPv6 table rules might affect forwarding. For example, if you create the following rule in the /etc/cumulus/acl/policy.d/03-sshd.rules file, the rule counter increments but IPv4 SSH traffic might be dropped.
|
3.7.2-3.7.11, 4.0.0-4.0.1 | 3.7.12-3.7.16, 4.1.0-4.4.5 |
| 2545505 |
If you change multiple BGP or BFD timers in the /etc/frr/frr.conf file and then reload FRR, a traceback is encountered and the change does not take effect. |
3.7.9-3.7.10 | 3.7.11-3.7.16 |
| 2545405 |
The ospfd daemon might crash with the following kernel trace:
|
3.7.6-3.7.10 | 3.7.11-3.7.16 |
| 2545316 |
When an interface flap occurs, numbered IPv6 BGP sessions might fail to establish. To work around this issue, run the ip -6 route flush cache command to flush the IPv6 route cache. |
3.7.9-3.7.11 | 3.7.12-3.7.16 |
| 2545235 |
On the Edgecore AS6812 switch, you might see rare I2C errors. | 3.7.2-3.7.10, 4.0.0-4.0.1 | 3.7.11-3.7.16, 4.1.0-4.4.5 |
| 2545193 |
switchd does not program multicast routes 224/8 into hardware. |
3.7.9-3.7.16 | 4.0.0-4.4.5 |
| 2545132 |
On the Mellanox switch, ACL lookups are performed for VLAN matches when no rules with UNTAGGED match are present. |
3.7.2-3.7.10, 4.0.0-4.0.1 | 3.7.11-3.7.16, 4.1.0-4.4.5 |
| 2545048 |
When networking fails to start properly, an MLAG memory leak occurs, which might cause memory issues. | 3.7.9-3.7.10, 4.0.0-4.0.1 | 3.7.11-3.7.16, 4.1.0-4.4.5 |
| 2545027 |
In the default VRF, VRRP might crash and stay in an initialize state. As a result, VRRP multicast traffic is not generated. | 3.7.8-3.7.10 | 3.7.11-3.7.16 |
| 2544978 |
If you delete an undefined bond, then add a bond slave, the net commit command fails. |
3.7.9-3.7.16, 4.0.0-4.4.5 | |
| 2544968 |
FRR configuration commands for an SVI interface might have the \n misplaced in the output. For example:
should be:
To work around this issue, configure the interface manually in the /etc/frr/frr.conf file. |
3.7.9-3.7.16, 4.0.0-4.4.5 | |
| 2544937 |
The neighmgrd service does not ignore neighbors on reserved devices (lo and management devices). This issue is not seen when management VRF is enabled. |
3.7.8-3.7.11 | 3.7.12-3.7.16 |
| 2544904 |
After you delete an IPv6 numbered BGP peer group neighbor, Cumulus Linux might continue to send route advertisements. To work around this issue, restart FRR after removing the IPv6 numbered configuration. |
3.7.9-4.1.1 | 4.2.0-4.4.5 |
| 2544846 |
You might experience a bgpd memory usage increase and significant update exchanges due to host moves between VTEPs. |
3.7.7-3.7.10, 4.0.0-4.0.1 | 3.7.11-3.7.16, 4.1.0-4.4.5 |
| 2544829 |
Frames received with a VLAN tag of 0 on an interface configured as a bridge port and forwarded to the CPU for processing might appear tagged with the native VLAN when viewed with tcpdump. |
3.7.8-3.7.16 | |
| 2544723 |
Setting ProtoDown on ports populated with SFP modules providing RJ-45 1000BASE-T interfaces does not cause the carrier to be dropped. The kernel shows carrier down; however, the remote device still shows a link. | 3.7.6-3.7.10, 4.0.0-4.4.5 | 3.7.11-3.7.16 |
| 2544624 |
VXLAN encapsulated ICMP packets hit the catchall EFP policer instead of the ICMP policer and you might experience partial packet loss. |
3.7.9-3.7.10, 4.0.0-4.0.1 | 3.7.11-3.7.16, 4.1.0-4.4.5 |
| 2544609 |
BGP is configured with soft reconfiguration-in for its peers, which is not working correctly and causes routes to have an unexpected label. As a result, transit traffic is not forwarded by the switch. | 3.7.7-3.7.16 | 4.0.0-4.4.5 |
| 2544559 |
When you install a large number of new rules with nonatomic mode enabled, there is a chance that you install more rules than the number of available slots in the slice, which results in the slice being completely wiped and reinstalled. This causes a large drop increase, including to cpu0, and might cause a major outage by dropping all BGP sessions. | 3.7.8-3.7.16 | 4.0.0-4.4.5 |
| 2544556 |
If you reconfigure an NTP server with NCLU using different trailing options after the IP address (such as iburst), an invalid configuration is added to the /etc/ntp.conf file. For example:
If you need to alter existing server configurations, first remove the server, commit, then re-add the server with any trailing options. |
3.7.9-4.1.1 | 4.2.0-4.4.5 |
| 2544463 |
Auto-negotiation does not work with the QSFP28 cables and a remote system operating at 10G. Attempting to enable auto-negotiation with ethtool -s swp<#> autoneg on returns Operation not supported.To work around this issue, do not use auto-negotiation and set the local port speed to 10G. |
3.7.9-3.7.16, 4.0.0-4.4.5 | |
| 2544456 |
The NCLU net show lldp command displays the speed of a ganged port group as the speed of one of the individual links, rather than the sum of their speeds. |
3.7.9-3.7.16, 4.0.0-4.4.5 | |
| 2544385 |
The QCT QuantaMesh BMS T7032-IX7 switch may report “failed to request GPIO pin” errors during the boot up. | 3.7.5-3.7.10 | 3.7.11-3.7.16 |
| 2544311 |
Applying a policy-based routing (PBR) rule for all traffic from a host might disrupt ARP refresh for that connected host. | 3.7.5-3.7.16, 4.0.0-4.4.5 | |
| 2544212 |
Cumulus Linux poed generates excessive debug log entries. These will be reduced in a future release. | 3.7.3-3.7.10, 4.0.0-4.0.1 | 3.7.11-3.7.16, 4.1.0-4.4.5 |
| 2544199 |
Traffic sent to the SVI IP address of a switch might be lost if all of the following conditions are met: * The switch is a member of an MLAG pair * The traffic is sourced from a layer 2 adjacent host * The host is located within a VRF of the MLAG pair * The traffic from the source crosses the peer link * VXLAN is configured on the MLAG pair This issue does not impact transit traffic or traffic that does not meet all of the described conditions. To workaround this issue, restart switchd. |
3.7.9-3.7.10, 4.0.0-4.0.1 | 3.7.11-3.7.16, 4.1.0-4.4.5 |
| 2544182 |
NCLU crashes when you run the net add interface storage-optimized pfc command because non-ascii quotes exist in the datapath.conf file.To work around this issue, manually edit the /usr/lib/python2.7/dist-packages/cumulus/__chip_config/mlx/datapath.conf file and replace the non-ascii single quotes with ascii single quotes (standard single quote on the keyboard). |
3.7.9-3.7.10 | 3.7.11-3.7.16 |
| 2544155 |
NCLU requires you to specify an interface with multiple address-virtual statements in ascending MAC address order. |
3.7.5-3.7.16, 4.0.0-4.4.5 | |
| 2544113 |
Mac learning is not disabled by default on a double tagged peer link interface resulting in the MAC address changing between the MLAG bond and the peer link. To work around this issue, disable MAC learning on QinQ VLANs by adding bridge-learning off to the VLAN stanza in the etc/network/interfaces file. |
3.7.9-3.7.16, 4.0.0-4.4.5 | |
| 2544073 |
After upgrading to Cumulus Linux 3.7.9 on a Broadcom switch, CPU generated traffic (such as ICMP, OSPF, ARP, and so on) egresses access ports with a 802.1Q header or interfaces with a bridge-pvid, with a VLAN ID of 0. Equipment from other vendors might drop this traffic. | 3.7.9 | 3.7.10-3.7.16 |
| 2544057 |
FRR crashes when adding an IPv6 neighbor with extended-nexthop capability. | 3.7.9-3.7.10 | 3.7.11-3.7.16 |
| 2544012 |
After you remove a subinterface, the BGP session stays in a Connect state. | 3.7.8-3.7.11 | 3.7.12-3.7.16 |
| 2543937 |
An interface alias configured outside FRR using iproute2 is imported into the FRR running configuration and overrides the internal description. After an FRR reload, this causes FRR to delete the interface alias in an inefficient way. Depending on how many interfaces with aliases you have configured, this can cause a FRR reload to time out.To work around this issue, remove the interface alias description from iproute2. |
3.7.8-3.7.10, 4.0.0-4.4.5 | 3.7.11-3.7.16 |
| 2543900 |
On the Mellanox switch, static VXLAN tunnels incorrectly allow traffic from any remote tunnel IP address. | 3.7.8-3.7.16, 4.0.0-4.4.5 | |
| 2543875 |
On the Mellanox Spectrum switch, a route withdrawal might cause the associated next hop neighbor entry to be deleted in hardware but remain in the kernel. This can cause traffic going through the directly connected route to the removed neighbor entry to be forwarded to the CPU. | 3.7.6-3.7.16 | 4.0.0-4.4.5 |
| 2543841 |
The net show evpn vni detail json command includes an extra empty dictionary at the end of the output. |
3.7.8-3.7.16, 4.0.0-4.4.5 | |
| 2543840 |
On the Mellanox SN2700 switch, you cannot enable resilient hashing (RASH) and set the bucket size to 64 in the traffic.conf file. |
3.7.6-3.7.16 | |
| 2543816 |
On the Dell S5248F-ON switch, smond might generate syslog messages indicating that the fan input RPM is lower than the normal low speed of 2500 RPM. Speeds as low as 1700 RPM are acceptable in normal thermal environments; therefore, you can ignore these messages. |
3.7.6-3.7.11, 4.0.0-4.4.5 | 3.7.12-3.7.16 |
| 2543800 |
When local-tunnelip is an SVI, the static VXLAN tunnel does not work; the next hop router receives the packet but drops it as it does not know where to forward the packet. The static VXLAN tunnel does works if local-tunnelip is a loopback or a physical layer 3 interface. |
3.7.8-3.7.16 | 4.0.0-4.4.5 |
| 2543792 |
On the EdgeCore AS5712, AS6712, AS5812 and AS6812 switch, support for multiple PSU types results in log messages similar to the following:
|
3.7.9-4.0.1 | 4.1.0-4.4.5 |
| 2543781 |
NCLU does not allow you to configure OSPF NSSAs. For example:
To work around this issue, use FRR instead. For example:
|
3.7.7-3.7.10, 4.0.0-4.4.5 | 3.7.11-3.7.16 |
| 2543727 |
ACL rules, such as the following, fail to install if you use swp+ (interfaces mentioned as wildcards).
You can now install such rules with swp+. |
3.7.3-3.7.16 | 4.0.0-4.4.5 |
| 2543724 |
If a hostname contains utf-8 characters, the NCLU net show lldp command outputs the following error:
|
3.7.7-3.7.10, 4.0.0-4.4.5 | 3.7.11-3.7.16 |
| 2543708 |
Cumulus Linux does not map QinQ packets to VXLANs in a configuration with a VLAN-aware bridge and MLAG on the Trident3 platform. |
3.7.9-3.7.16 | 4.0.0-4.4.5 |
| 2543689 |
On the Mellanox switch, UFT profiles are unable to support the documented capacity for routes to addresses that are more than 64 bits in length. The listed capacities assume 64-bit destination IP addresses. | 3.7.8-3.7.10, 4.0.0-4.0.1 | 3.7.11-3.7.16, 4.1.0-4.4.5 |
| 2543667 |
On the EdgeCore AS4610 switch, the ping command fails unless you run the command with sudo. To work around this issue, run the following commands:
Run the following command to verify the workaround:
You should see the following output:
|
3.7.6-3.7.10, 4.1.0-4.1.1 | 3.7.11-3.7.16, 4.2.0-4.4.5 |
| 2543665 |
clagd memory consumption increases under certain unknown conditions. |
3.7.8-3.7.16 | 4.0.0-4.4.5 |
| 2543648 |
You cannot specify a source and destination MAC address in an ERSPAN ebtables rule. For example, the following rule does not work:
|
3.7.6-3.7.12, 4.0.0-4.1.1 | 3.7.13-3.7.16, 4.2.0-4.4.5 |
| 2543647 |
ERSPAN in ebtables does not work for VNIs. For example, the following rule does not work:
|
3.7.6-4.2.1 | 4.3.0-4.4.5 |
| 2543646 |
In an ebtables rule, ERSPAN (upper case) does not work. You need to specify erspan (lower case). | 3.7.6-3.7.16, 4.0.0-4.4.5 | |
| 2543627 |
Tomahawk 40G DACs cannot disable auto-negotiation. | 3.7.7-3.7.16 | 4.0.0-4.4.5 |
| 2543473 |
Configuring an inbound route map to manually change the next hop IP address received from an eBGP peer locally causes the next hop to not be updated when advertising this route out to other eBGP peers. To work around this issue, set a “dummy” route map outbound to the eBGP peer or configure the route map to manually set the next hop outbound from the originating eBGP peer. | 3.7.6-3.7.10 | 3.7.11-3.7.16 |
| 2543472 |
On switches with the Spectrum ASIC, the underlay hashes VXLAN packets for a given overlay flow randomly. To work around this issue, configure the ECMP hash seed to the same value on the EVPN egress leaf switches. |
3.7.7-4.0.1 | 4.1.0-4.4.5 |
| 2543374 |
After a remote VTEP peer link goes down, the tunnel destination IP address might be incorrect in hardware, which might cause loss of overlay communication between VTEPs. | 3.7.8-3.7.16 | 4.0.0-4.4.5 |
| 2543325 |
Lenovo switches do not send or receive LLDP on eth0 interfaces. | 3.7.7-3.7.16 | 4.0.0-4.4.5 |
| 2543270 |
The default route injected through OSPF when you configure default-information originate always is unreliable and might age out unexpectedly.To work around this issue, rely on a different source of default route other than injection with default-information originate. |
3.7.8-4.1.1 | 4.2.0-4.4.5 |
| 2543211 |
In some cases, the switchd service might warn of excessive MAC moves from one switch port to itself (for example, from swp18 to swp18). |
3.7.0-3.7.16, 4.0.0-4.4.5 | |
| 2543164 |
The MTU of an SVI cannot be higher than the MTU on the bridge. Changing the MTU on the SVI with NCLU does not update the bridge MTU. The net commit command succeeds even though the MTU is not changed as expected.To work around this issue, change the MTU on all SVIs and the bridge manually in the /etc/network/interfaces file, then apply the change with the ifreload -a command. |
3.7.7-3.7.16, 4.0.0-4.4.5 | |
| 2543113 |
NCLU restarts FRR when attempting to remove a BGP VRF stanza. This happens regardless of whether the VRF is valid/configured elsewhere on the switch or the removal is successful. To work around this issue, remove the stanza using vtysh. |
3.7.3-3.7.16 | 4.0.0-4.4.5 |
| 2543096 |
When an SVI with a virtual MAC is configured with a layer 2 VNI in an EVPN environment, if you replace the /etc/network/interfaces file with a different file that does not have the SVI and layer 2 VNI configuration, the original virtual MAC is not populated through the EVPN route until FRR is restarted. |
3.7.6-3.7.16, 4.0.0-4.4.5 | |
| 2543058 |
The IP neighbor entry for a link-local next hop is not installed by FRR, which results in a forwarding failure for routes via that next hop. This is a rare problem that occurs with IPv4 route exchange over IPv6 GUA peering with no IPv4 addresses on the interfaces. To work around this issue, flap the peering to the peer router (which might be a route reflector) to recover. To avoid this issue, configure IPv6 router advertisements on the connecting interfaces. |
3.7.7-3.7.16 | 4.0.0-4.4.5 |
| 2543052 |
Received EVPN type-5 and type-2 MACIP routes are not installed in the kernel (and hardware) routing tables for the associated VRF, which causes traffic to be blackholed. The failure to install the default route causes complete reachability failure for the particular tenant on the affected racks. The routes that are not installed are seen as “inactive” in the routing subsystem (FRR) VRF routing table. This problem is rare and can occur only in EVPN configurations that have user-configured route targets (RTs) for tenant VRFs, and only following a restart of FRR. To work around this issue, either restart the FRR service on the affected switch with the sudo systemctl restart frr.service command or bounce the layer 3 SVI for the affected VRF; for example:
You can run the net show vrf vni command to print a mapping of VRF : L3-VNI : L3-SVI. |
3.7.5-3.7.16 | 4.0.0-4.4.5 |
| 2543044 |
Under certain conditions, EVPN next hops might not be removed when the contributing peer goes down or might not be populated when the BGP session to the contributing peer comes up. You can prevent EVPN next hops from not being removed when the contributing peer goes down by specifying static MAC addresses on all layer 3 VNIs. There is no workaround for preventing EVPN next hops from not being populated when the BGP session to the contributing peer comes up. |
3.7.2-3.7.16 | 4.0.0-4.4.5 |
| 2542979 |
On the Dell-N3048EP-ON switch, when you run the sudo -E apt upgrade command, the upgrade does not work. |
3.7.7-4.1.1 | 4.2.0-4.4.5 |
| 2542958 |
When transitioning from a down state to an up state due to peerlink failure and recovery, MLAG does not start the initDelay timer before trying to bring everything back up. | 3.7.7-3.7.16 | 4.0.0-4.4.5 |
| 2542945 |
On the Broadcom Maverick switch with a QinQ configuration, the packets coming into the CPU might be tagged incorrectly; for example, 802.1ad + 802.1q tags are expected in the packets but the packets have 802.1q + 802.1q tags. To work around this issue, configure the bridge with bridge-vlan-protocol 802.1ad:
|
3.7.6-3.7.16, 4.0.0-4.4.5 | |
| 2542913 |
IF-MIB::ifHCInOctets reports significantly lower values than reported by interface counters seen elsewhere. | 3.7.6-3.7.16 | 4.0.0-4.4.5 |
| 2542871 |
After you issue the NCLU net del bgp vrf command and commit the change, Cumulus Linux does not remove the configuration from the /etc/frr/frr.conf file or the net show config commands. |
3.7.3-3.7.10, 4.0.0-4.0.1 | 3.7.11-3.7.16, 4.1.0-4.4.5 |
| 2542835 |
snmpd fails because NCLU does not remove agentaddress @vrf lines when running the net add snmp-server listening-address all command. |
3.7.4-3.7.16 | 4.0.0-4.4.5 |
| 2542823 |
On the Broadcom Trident 3 switch, VXLAN encapsulated packets are dropped on the ingress port (tagged layer 2 port) during transit forwarding (the local switch does not terminate the VXLAN tunnel). An example of where this two-layer VXLAN inside VXLAN encapsulation might occur: - VXLAN tunnel (#1) between two servers (different racks) to provide layer 2 extension for containers or VM hosts. - VXLAN tunnel (#2) between the TOR switch in rack 1 to the TOR switch located in the remote rack. To work around this issue, either: - Configure the edge port (facing the servers) to be an access port (instead of a trunk/tagged port) - Change the destination port from 4789 to something else (VXLAN tunnel terminated by the servers) |
3.7.5-3.7.11, 4.0.0-4.0.1 | 3.7.12-3.7.16, 4.1.0-4.4.5 |
| 2542767 |
If the BMC operating system fails to respond to IPMI, you see a traceback in bmcd and all the sensors might report ABSENT devices in smonctl. To work around this issue, power cycle the switch. |
3.7.6-4.0.1 | 4.1.0-4.4.5 |
| 2542765 |
When you configure the switch to send an EAP request with the net add dot1x send-eap-request-id command, the switch ignores re-authentication attempts and does not send back an EAPol. |
3.7.6-3.7.10 | 3.7.11-3.7.16 |
| 2542509 |
In EVPN symmetric or centralized configurations with BGP peering over a peer link, VXLAN routed packets transiting an MLAG peer are dropped until the clagd init-delay timer expires during the bring-up sequence following a reboot.The problem is caused by a race condition when programming the anycast IP address (used to terminate VXLAN tunnels), where the hardware is programmed before the software by clagd.To work around this issue, configure the BGP path across the peer link to be less preferred. The example below uses AS path prepending and the MLAG switches are iBGP neighbors. However, other BGP configurations achieve the same result. In the /etc/frr/frr.conf file, make a new AS path access list and route map to apply BGP pre-pending of the local ASN one or more times. For example:
|
3.7.6-3.7.10, 4.0.0-4.0.1 | 3.7.11-3.7.16, 4.1.0-4.4.5 |
| 2542384 |
When you define a trap destination using @mgmt, snmpd indicates that the network is unreachable even though the IP address is reachable in the management VRF. To work around this issue, remove @mgmt vrf references in the /etc/snmp/snmpd.conf file, stop snmpd, then start snmpd manually in the management VRF with the systemctl start snmpd@mgmt command. |
3.7.6-3.7.16 | 4.0.0-4.4.5 |
| 2542310 |
hsflow disregards the setting for agent.cidr in the /etc/hsflowd.conf file and selects an IPv6 agent address. The source IP address of the hsflowd packet is IPv4, but the agent address in the hsflow payload shows IPv6. |
3.7.6-3.7.16 | |
| 2542305 |
If an SVI exists in the configuration before you assign it an IP address, when you do assign the IP address with the NCLU command, the vlan-id and the raw-device bridge stanzas are not added automatically. |
3.7.6-3.7.16, 4.0.0-4.4.5 | |
| 2542301 |
When first creating a bond and enslaving an interface, NCLU hides some of the bridge command suggestions, although they are still accepted. |
3.7.3-3.7.16, 4.0.0-4.4.5 | |
| 2542248 |
When you generate a cl-support file, clagd.service prints log messages similar to the following:
|
3.7.6-3.7.16 | 4.0.0-4.4.5 |
| 2542100 |
On the EdgeCore AS7816 switch, PCIE errors cause switchd startup to fail. |
3.7.9-3.7.16 | 4.0.0-4.4.5 |
| 2541212 |
The maximum-prefix configuration under the IPv4 address family has an optional restart value, which you can configure. This configuration is ignored and, instead of restarting the sessions every x minutes, the peer constantly changes between established and idle due to the prefix count being exceeded. |
3.7.5-3.7.16, 4.0.0-4.4.5 | |
| 2541165 |
On the Dell N3048EP-ON switch, UPOE is supported only on ports 1 thru 12. (UPOE uses all four pairs of standard Ethernet cabling whereas PoE delivers power over two twisted pairs.) When you plug a UPOE device in a port higher than port 12, poectl reports that four_pair_mode_enabled is true. However, this configuration is not supported on the port so poectl should report that four_pair_mode_enabled is false. |
3.7.6-3.7.16 | |
| 2541029 |
On switches with the Trident2 ASIC, 802.1Q-encapsulated control plane traffic received on an interface with 802.1AD configured subinterfaces might be dropped. This issue only affects QinQ configurations. |
3.7.5-3.7.16, 4.0.0-4.4.5 | |
| 2540950 |
On the QuantaMesh T4048-IX8 or EdgeCore AS7326-56X switch, when using a 1000BASE-T SFP module, the module LEDs do not light to reflect link status. |
3.7.3-4.1.1 | 4.2.0-4.4.5 |
| 2540885 |
The Dell N3048EP-ON switch does not support 1G Base-T modules in the SFP ports. | 3.7.7-3.7.16 | |
| 2540863 |
On the EdgeCore AS5812-54X switch, the PSU2 Fan1 fluctuates between OK and LOW. When the fan speed is reported as LOW, the RPM is shown as a negative number. |
3.7.3-3.7.16 | |
| 2540753 |
If the interface alias contains a single or double quotation mark, or an apostrophe, the net show configuration commands fail with the following error:
|
3.7.5-3.7.16, 4.0.0-4.4.5 | |
| 2540444 |
SNMP incorrectly requires engine ID specification. |
3.7.4-3.7.16, 4.0.0-4.4.5 | |
| 2540352 |
When you use NCLU to configure a route map, the parser allows for glob matching of interfaces for a match interface condition when there can only be a single interface matched. The proper syntax is to use multiple route map clauses, each matching a single interface, instead of a single clause matching multiple interfaces. For example, this command is incorrect:
These commands are correct:
|
3.7.2-3.7.16, 4.0.0-4.4.5 | |
| 2540340 |
NCLU allows for the configuration of addresses on VRF interfaces, but tab completion for the net add vrf command just displays
Tab completion for the net add vrf command works correctly. |
3.7.4-3.7.16, 4.0.0-4.4.5 | |
| 2540274 |
On the Maverick switch, CPU forwarded packets might be dropped when there is no route to a leaked host route. | 3.7.5-3.7.16, 4.0.0-4.4.5 | |
| 2540204 |
When links come up after FRR is started, VRF connected routes do not get redistributed. | 3.7.4-3.7.16, 4.0.0-4.4.5 | |
| 2540192 |
The net del bridge bridge mcsnoop yes command does not return the value to the default of disabled. To work around this issue, use the net add bridge bridge mcsnoop no command to delete the mcsnoop attribute and return to the default value. |
3.7.4-3.7.16, 4.0.0-4.4.5 | |
| 2540155 |
On the Broadcom switch, when moving configuration from bridged to routed (or toggling from routed to bridged to routed), some traffic is not seen by the kernel. This can cause BGP to not establish on a transit node. |
3.7.3-3.7.16, 4.0.0-4.4.5 | |
| 2540042 |
When you try to configure the VRRP priority and advertisement-interval with NCLU on a traditional mode bridge, the net commit command fails. To work around this issue, use the vtysh command (inside FRR) to change the VRRP priority or advertisement-interval on traditional bridges. For example:
|
3.7.4-3.7.16, 4.0.0-4.4.5 | |
| 2540041 |
On SVIs in a VLAN-aware bridge, you cannot change the VRRP priority with NCLU. To work around this issue, run the vtysh command inside FRR to change the default priority. For example:
|
3.7.4-3.7.16, 4.0.0-4.4.5 | |
| 2540040 |
Cumulus Linux uses VRRPv3 as the default version, and enables both preempt and accept mode by default. You cannot change these default values with NCLU. To work around this issue, run the vtysh commands (inside FRR) to change the default values. For example:
|
3.7.4-3.7.16, 4.0.0-4.4.5 | |
| 2540031 |
NCLU does not honor auto all in the /etc/network/interfaces file and removes the existing configuration if no individual auto lines exist. |
3.7.3-3.7.16, 4.0.0-4.4.5 | |
| 2539994 |
When you try to remove a BGP peer group configuration with NCLU, the command fails but no warning message is shown. For example:
|
3.7.2-3.7.16, 4.0.0-4.4.5 | |
| 2539962 |
When an LDAP user that does not have NCLU privileges (either in the netshow or netedit group, or in the /etc/netd.conf file) runs an NCLU command, a traceback occurs instead of a permissions error. |
3.7.0-3.7.16, 4.0.0-4.4.5 | |
| 2539670 |
On the Edgecore 4610-54P switch, automatic medium-dependent interface crossover (auto-MDIX) stops working on a 100M full duplex interface and does not detect the required cable connection type. |
3.7.2-3.7.16, 4.0.0-4.4.5 | |
| 2539124 |
The net add interface command adds no ptm-enable for that interface in the frr.conf file. Running the net add or the net del command does not remove no ptm-enable from the frr.conf file. You have to remove it manually using vtysh. |
3.7.2-3.7.16, 4.0.0-4.4.5 | |
| 2539081 |
When you delete post-up and pre-down IP peer entries from the etc/network/interfaces file, then run the ifreload command, the IP addresses are not removed and the route remains in the route table. To work around this issue, either delete the IP addresses without the /32 mask component or flush the IP addresses for the interface with the ip addr flush dev command. |
3.7.0-3.7.16 | 4.0.0-4.4.5 |
| 2538875 |
IPv6 multicast traffic destined to an unregistered multicast group is flooded to all ports in a bridge despite the bridge.optimized_mcast_flood = TRUE setting in the /etc/cumulus/swichd.conf file. |
3.7.2-3.7.16 | |
| 2538790 |
NCLU automatically adds the VLAN ID (for the layer 3 VNI/SVI) to the bridge when you run net add vxlan . This configuration breaks network connectivity in an EVPN symmetric routing configuration using MLAG. To restore connectivity, remove the VLAN ID from the bridge. |
3.7.2-3.7.16, 4.0.0-4.4.5 | |
| 2538590 |
When you configure a control plane ACL to define permit and deny rules destined to the local switch, NCLU programs the control plane ACL rules into the FORWARD chain. |
3.7.2-3.7.16, 4.0.0-4.4.5 | |
| 2538562 |
On an RMP/1G-T switch, when you remove link-speed 100 with the NCLU command or by editing the etc/network/interfaces file to revert the 100M interface to the default (1G auto), the interface fails to recover and does not come back up.After you remove the link-speed, ethtool shows the advertised link modes as not reported and Speed/Duplex as unknown.To work around this issue and bring the interface back up, either restart switchd or use ethtool to configure the speed, advertised, duplex or MDI-X settings. Note: The advertised link mode gets set incorrectly if you include 1000baseT/Half. The port will come up successfully at 1G. |
3.7.2-3.7.16, 4.0.0-4.4.5 | |
| 2538302 |
portwd allows an error to change the module type based on the error. For example, a bad write to a module might cause the module type to flap, which causes the link itself to flap. |
3.7.0-3.7.16 | |
| 2538294 |
If you use NCLU to create an iBGP peering across the peer link, running the net add bgp l2vpn evpn neighbor peerlink.4094 activate command creates a new eBGP neighborship when one has already been configured for iBGP. This is unexpected; the existing iBGP configuration is valid. |
3.7.0-3.7.16, 4.0.0-4.4.5 | |
| 2538256 |
On the Broadcom switch, when a link-local multicast frame is received on an access port with a VNI in the bridge, two copies of the packet are sent across the VNI to remote VTEPs and the receiving hosts observe duplicate packets. |
3.7.2-4.0.1 | 4.1.0-4.4.5 |
| 2537819 |
When you enable FEC (RS or BaseR) on an interface, removing the configuration from that interface does not revert the FEC status to off/none. |
3.7.2-3.7.16 | 4.0.0-4.4.5 |
| 2537699 |
There is a limitation on the number of SVI interfaces you can specify as DHCP relay interfaces in the /etc/default/isc-dhcp-relay file. For example, 1500 SVI interfaces causes the dhcrelay service to exit without a core file and logs similar to the following are generated for the interfaces:
Eventually the dhcrelay service stops. |
3.7.1-3.7.16, 4.0.0-4.4.5 | |
| 2537544 |
When you run the mstpctl command, you might see the bridge-port state as blocking when it is actually disabled. You might see the same incorrect bridge-port state when other programs or tools use the output of mstpctl; for example, SNMP output from the BRIDGE-MIB. |
3.7.1-3.7.16, 4.0.0-4.4.5 | |
| 2537536 |
When FRR restarts, snmp[err] dev/kmem: Permission denied error messages are recorded in the log file and SNMPd might crash periodically. |
3.7.5-3.7.16 | 4.0.0-4.4.5 |
| 2537378 |
NCLU SNMPv3 user configuration (add, delete, modify) does not complete. Changes are made to the /etc/snmp/snmpd.conf file but the SNMPv3 user cache file /var/lib/snmp/snmpd.conf fails to update correctly and the configuration does not reflect in operation. To work around this issue, stop snmpd, remove the cache file, then restart snmpd. |
3.7.1-3.7.16 | |
| 2537188 |
When an event in the network, such as a switchd or networking service restart, leads to an OVSDB server high availability transition, an ovs-vtepd core might occur. This core generation has no effect on the functionality of high availability when the active OVSDB server is back in the network. |
3.7.2-3.7.16 | |
| 2537104 |
When you try to stop hsflowd on the Trident II+ switch with the systemctl stop hsflowd command, the process hangs until you stop it with SIGKILL. |
3.7.1-3.7.16 | 4.0.0-4.4.5 |
| 2537061 |
The Dell S5048F-ON switch (with reverse airflow, rear to front), shows the Temp-3 sensor as absent. |
3.7.1-4.0.1 | 4.1.0-4.4.5 |
| 2536639 |
On a Dell S4048 switch, when you set the eth0 speed to 100, either with NCLU or by editing the /etc/network/interfaces file, the igb driver crashes, which brings down eth0. To work around this issue: * If eth0 is configured in the management VRF, power cycle the switch; the eth0 configuration fails and reverts back to the default (auto-negotiation/1000). * If eth0 is configured in the default VRF and you power cycle after the crash, igb continues to crash on boot up (before getting to login prompt); power-cycle the switch, select the Advanced option in GRUB to boot to recovery mode, then modify the /etc/network/interfaces file. |
3.7.0-3.7.16 | 4.0.0-4.4.5 |
| 2536608 |
Single tagged ARP requests received on a QinQ-over-VXLAN access port are dropped if ARP suppression is enabled on an unrelated VNI. |
3.7.0-3.7.16 | |
| 2536559 |
When deleting an interface using NCLU, if the /etc/network/interfaces alias is different than the /etc/frr/frr.conf description, the net commit command returns the following error:
Despite this error, the change is made and the description is removed from the frr.conf file. |
3.7.3-3.7.10 | 3.7.11-3.7.16 |
| 2536384 |
The BFD packet redirection logic used by OVSDB server high availability mode redirects BUM packets across the peer link. The iptables rule for redirection does differentiate between BFD and non-BFD VXLAN inner packets because the service node sends all frames with its own IP address as the tunnel source IP address. The VXLAN encapsulated BUM packets do not get forwarded to the CPU and do not go through the iptable redirection rule; only VXLAN encapsulated BFD packets get forwarded to the CPU due to the inner MAC DA lookup in hardware. |
3.7.0-3.7.16, 4.0.0-4.4.5 | |
| 2536230 |
On the Broadcom switch with the Trident3 ASIC, the ECN-CE bit is set by default on transit traffic. This might result in hosts adjusting traffic behavior if they are configured for the ECN feature. In Cumulus Linux 3.7.11, the default behavior changed; the ECN-CE bit is no longer set by default on transit traffic. |
3.7.3-3.7.10, 4.0.0-4.0.1 | 3.7.11-3.7.16, 4.1.0-4.4.5 |
| 2536179 |
On switches with the Trident 2+ ASIC, counters associated with VLANs and VRFs are not working. | 3.7.0-3.7.16, 4.0.0-4.4.5 | |
| 2535986 |
At a high CPU transmit traffic rate (for example, if there is unexpected CPU generated flooding or replication in software), when the ASIC packet driver cannot keep up with the transmit rate because there are no free DMA buffers, it can back pressure by suspending the switch port transmit queues. This can fill up the application socket buffers resulting in No buffer space available error messages on protocol sockets.When the driver recovers, it automatically resumes the transmit queues. In most cases these error messages are transient. In rare cases, the hardware queues might get stuck, which you can recover with a switchd restart. |
3.7.0-3.7.16, 4.0.0-4.4.5 | |
| 2535965 |
On the Trident3 switch, static PIM with IIF based on a layer 2 bridge does not work reliably. PIM Join via signaling is required for IPMC to work properly. To work around this issue, use dynamic signaling (joins) to manage IP multicast traffic. |
3.7.0-3.7.16, 4.0.0-4.4.5 | |
| 2535209 |
The net show lldp command sometimes shows the port description in the Remote Port field. The net show interface command shows the correct value in the Remote Host field.To work around this issue, use net show interface command for LLDP output when connected to Cisco equipment. |
3.7.5-3.7.10, 4.0.0-4.4.5 | 3.7.11-3.7.16 |
| 2534450 |
The default BGP instance must be provisioned and always exist for proper operation of dynamic leaking of routes between VRFs. | 3.7.0-3.7.16 | 4.0.0-4.4.5 |
| 2528990 |
During a link flap test, you might occasionally see a message similar to: warning: swp6: netlink: cannot set link swp6 down: [Errno 98] Address already in use. |
3.7.6-3.7.10 | 3.7.11-3.7.16 |
Fixed Issues in 3.7.9
| Issue ID | Description | Affects |
|---|---|---|
| 2543546 |
{watchfrr calls sudo /usr/sbin/service frr restart bgpd but restarts all FRR daemons which can cause a large outage. This occurs because watchfrr uses an old style service command, which causes all daemons to restart when a daemon fails. |
3.7.7-3.7.8 |
| 2543469 |
When using the UFT lpm-equal profile, IPv6 routes are limited to 16K. | 3.7.8 |
| 2543389 |
Dynamic route-leaking works as expected until FRR is restarted or the switch is rebooted. After the restart or reboot, the import RT under the VRF where routes are being imported is incorrect. | 3.7.7-3.7.8 |
| 2543004 |
Cumulus Linux installer images have a shell script that validates checksum integrity. When you run onie-install, this check is run but the installer is still staged even if the checksum validation fails. To work around this issue, perform your own checksum validation before staging a new image with onie-install. |
3.7.7-3.7.8 |
| 2542985 |
On a Tomahawk switch, the 5m 40G DACs (40G CR4) do not come up when both sides have auto-negotiation enabled. | 3.7.7-3.7.8 |
| 2542965 |
A port that is used as both a double tag interface and a VXLAN access side interface does not forward correctly; VXLAN decapsulation is does not occur. However, do not configure double tagged interfaces on VXLAN uplink ports as this will cause VXLAN routing issues. | |
| 2542938 |
When MLAG is re-establishing its peering after a member reboot, the VNIs on the peer briefly go into a protodown state. This can cause complete downtime to dually connected hosts as the member coming back up is still in initDelay. This issue does resolve itself as the VNIs do come back up within ten seconds. |
3.7.8 |
| 2542853 |
For interfaces configured with RS FEC, when switchd is restarted, the link goes down but does not automatically come back up. This occurs because the FEC status is not replayed correctly into the kernel. To work around this issue, run the ifreload -a command to bring up the interface after switchd is restarted. |
3.7.6-3.7.8 |
| 2542837 |
On Mellanox switches, policer iptables are not working as expected. For example, when using a policer with mode KB/MB/GB to rate-limit interfaces, the syntax is accepted but the data plane transfer speed is not affected by the rule. | 3.7.6-3.7.8, 4.0.0-4.4.5 |
| 2542819 |
On the Trident3 platform, you can only add 50 percent of the total ECMP next hops. A log message indicates that the table is full. | 3.7.7-3.7.8 |
| 2542774 |
When moving an IP address from the address line to inet dhcp, then issuing the ifreload -a command, the old address is not removed from the interface. NCLU still reports the old address only and reports it as a DHCP address. |
3.7.6-3.7.8 |
| 2542726 |
After configuring switchd hal.bcm.per_vlan_router_mac_lookup to TRUE on a Broadcom switch, layer 2 traffic works over VXLAN but the host is not able to ping the locally connected gateway and loses routing ability to other IPs and subnets. |
3.7.5-3.7.8 |
| 2542711 |
BGP update packets are sometimes missing the mandatory nexthop attribute, which causes connections to reset. For example, this issue is seen when using VRF route leaking with a mix of BGP unnumbered and BGP numbered peers. |
3.7.6-3.7.8 |
| 2542480 |
When BGP remove-private-AS replace-AS is configured under the BGP IPv4 or IPv6 address family between a pair of switches configured as BGP peers, a BGP route update might cause the BGP session to flap. To work around this issue, do not configure remove-private-AS replace-AS in the BGP IPv4 or IPv6 address family. |
3.7.6-3.7.8 |
| 2542472 |
On Broadcom-based VXLAN routing capable platforms, VXLAN traffic received at the egress VTEP might drop because the hardware is mis-programming. This issue is related to timing and is not easily reproduced. This issue might occur after a VXLAN interface (VNI) state transition (the peerlink goes down and puts VNI into a protodown state, then the peerlink comes back and the VNI returns to UP) and is related to how the next-hop information is programmed in hardware. Sometimes the host routes corresponding to this VXLAN segment are mis-programmed with the wrong next hop information. To work around this issue, restart the switchd service with the sudo systemctl restart switchd.service command. |
|
| 2542365 |
The snmpd service frequently crashes due to double free or corruption. |
3.7.6-3.7.8 |
| 2542341 |
The IP neighbor entry for a link-local next hop (169.254.x.x) is not installed by FRR, which results in a forwarding failure for routes via that next hop. This is a rare problem that occurs with IPv4 route exchange over IPv6 GUA peering with no IPv4 addresses on the interfaces. To work around this issue, flap the peering to the peer router (which can be a route reflector) to recover. To avoid this issue, configure IPv6 router advertisements on the connecting interfaces. |
3.7.7-3.7.8 |
| 2542336 |
On the Mellanox SN2410 switch, switchd does not start. |
3.7.2-3.7.8 |
| 2542297 |
When you run the NCLU net del all command, the exec-timeout setting changes in the /etc/frr.frr.conf file. |
3.7.6-3.7.8 |
| 2542193 |
When you configure the link-down yes attribute to a physical SVI, the VRR (-v0) interface is not brought down, and the locally-connected subnet can still be redistributed into routing protocols and advertised to neighbors despite the physical SVI being administratively down. To work around this issue, manually bring down the VRR (-v0) interface with the ip link set dev command. For example:
|
3.7.6-3.7.8 |
| 2542058 |
The ifquery command should return a non-zero value if there is a syntax error. However, it currently returns zero. This issue affects automation scripts that validate a file before copying it into place. |
3.7.6-3.7.8 |
| 2542031 |
If you configure a sys-mac with a single digit, ifreload -a does not indicate that the MAC address is invalid for the MLAG sys-mac and the clagd process fails silently. |
3.7.6-3.7.8 |
| 2541924 |
If the address-virtual MAC address is missing a leading zero in the last octet, the interface bounces. |
3.7.6-3.7.8 |
| 2541604 |
The snmpd service exits with a message similar to the following:
This problem might occur during or after network convergence events. For example, when bgpd needs to process a high number of updates and the CPU cannot keep up, bgpd is disconnected and agentx generates a core dump in snmpd due to a memory allocation problem. To work around this issue, disable agentx by commenting out the following lines in the /etc/snmp/snmpd.conf file. Then, restart the snmpd service with the systemctl restart snmpd command.
If you still want to poll the BGP4-MIB information, re-enable the bgp pass persist script by adding the following line in the /etc/snmp/snmpd.conf file:
|
3.7.2-3.7.8 |
| 2541003 |
NCLU is unable to delete a BGP neighbor configuration if there is a VRF VNI mapping in the /etc/frr/frr.conf file. For example, the following NCLU command produces an error:
|
3.7.7-3.7.8 |
| 2540684 |
On a Dell S5248F (Trident3) switch, packets from switch ports are forwarded to the CPU and are sometimes corrupted. The corruption might result in BGP peerings being down, which can lead to all VXLAN traffic to and from a node to be lost, causing an outage to dually connected hosts in a rack. To work around this issue, restart switchd. |
3.7.3-3.7.8 |
| 2540600 |
If the clagd-vxlan-anycast-ip is removed from the /etc/network/interfaces file (either with the NCLU command or by editing the file manually), MLAG still believes it is present until clagd restarts. |
3.7.3-3.7.8 |
| 2540359 |
bgpd creates a core dump at zclient_send_interface_radv_req. This is an issue with how FRRouting checks next hops and has been pushed upstream to FRRouting. |
3.7.6-3.7.8 |
| 2538741 |
The NCLU command net show bridge spanning-tree does not show the MLAG peer link as part of the STP forwarding instance.To work around this issue, use the mstpctl command to confirm the STP status of the port. |
3.7.2-3.7.8 |
| 2538480 |
Modifying the /etc/netd.conf file to set show_linux_command = True does not take effect. |
3.7.2-3.7.8 |
| 2538321 |
On the Trident3 switch, the input chain ACLs drop action forwards packets if the traffic is destined to the CPU on an SVI. | |
| 2538022 |
When you remove an interface from a bridge and add it to a VRF in the same commit/ifreload, the IPv6 link-local address is not created automatically. To work around this issue, do the change in two separate commits. First, remove the interface from the bridge, which causes it to be a layer 2 interface. Then, enslave the interface to the VRF. |
3.7.2-3.7.8 |
| 2537153 |
In rare cases, certain IPv6 BGP peers fail to reestablish after switchd restarts. |
3.7.2-3.7.8 |
| 2536650 |
Mellanox Spectrum and Helix4 switches occasionally send malformed packets and do not send any flow samples (only counters). While this issue is fixed for switches with the Spectrum ASIC, this is a [known limitation|https://docs.cumulusnetworks.com/cumulus-linux/Monitoring-and-Troubleshooting/Network-Troubleshooting/Monitoring-System-Statistics-and-Network-Traffic-with-sFlow/#caveats-and-errata] on this Helix4 platform. |
3.7.0-3.7.8 |
| 2536154 |
By default, the nginx server used for the HTTP API on port 8080 is enabled, but does not listen to external requests. However, it appears to be listening and answering external requests. | |
| 2535445 |
If a VNI is configured before the bridge in /etc/network/interfaces, the switch does not send IGMP queries. To work around this issue, edit the /etc/network/interfaces file to define the bridge before the VNI. For example:
. |
|
| 2534887 |
The NCLU net show lldp and net show interface commands do not show LLDP information for swp* (eth is unaffected). |
|
| 2532395 |
Drops due to congestion do not appear to be counted on a Mellanox switch. To work around this issue, run the sudo ethtool -S swp1 command to collect interface traffic statistics. |
3.7.8 Release Notes
Open Issues in 3.7.8
| Issue ID | Description | Affects | Fixed |
|---|---|---|---|
| 3410952 |
If MLAG is configured but disconnected from an MLAG peer for an extended period of time (days or more), there is a long delay (up to a minute per day) before traffic forwarding stabilizes after the MLAG peer connection re-establishes. | 3.7.0-4.3.1 | 4.3.2-4.4.5, 5.5.0-5.15.0 |
| 3376798 |
On Broadcom switches, Cumulus Linux does not create the hardware bridging domain for a traditional bridge with a VXLAN interface during switchd restart. The /var/log/switchd.log file includes the following exception logs shortly after switchd restarts:switchd[30158]: hal_bcm_l3.c:1617 find_egr_path_if_vxlan_overlay:vxlan overlay : nh PORT: port <#>, vlanMAC learning looks correct, but traffic does not flow as expected. |
3.7.0-4.3.1 | 4.3.2-4.4.5 |
| 3330705 |
When using TACACS+, a TACACS+ server name that returns more than one IP address, such as an IPv6 and IPv4 address, is counted many times against the limit of seven TACACS+ servers, which might cause some of the later listed servers to be ignored as over the limit. To work around this issue, you can set the prefer_ip_version configuration option (the default value is 4) to choose between an IPv4 or IPv6 address if both are present. |
3.7.0-5.3.1 | 5.4.0-5.15.0 |
| 3327477 |
If you use su to change to a user specified through TACACS+, the user becomes the local tacacs0 thru tacacs15 user instead of the named user to run sudo commands. As a result, the named user password might not match the local tacacs0 thru tacacs15 user password. |
3.7.0-3.7.16, 4.0.0-4.4.5, 5.0.0-5.15.0 | |
| 3216921 |
RADIUS authenticated users with read-only access to NCLU commands (users in the users_with_show list) can run edit commands if a username for a non-local account is on the users_with_edit line of the /etc/netd.conf file. To work around this issue, make sure that all usernames on the users_with_edit line of the /etc/netd.conf file are configured local users for the system (real Linux users) |
3.7.0-3.7.16, 4.3.0-4.4.5 | |
| 3209699 |
RADIUS authenticated users with read-only access to NCLU commands (users in the users_with_show list) can run edit commands if a username for a non-local account is on the users_with_edit line of the /etc/netd.conf file. To work around this issue, make sure that all usernames on the users_with_edit line of the /etc/netd.conf file are configured local users for the system (real Linux users) |
3.7.0-4.3.0, 4.4.0-5.2.1 | 4.3.1, 5.3.0-5.15.0 |
| 2660582 |
In an MLAG configuration, the secondary MLAG switch does not use a unique address instead of the MLAG system MAC address when there is a double failure (backup IP and peer link failure) To recover restart the clagd service with sudo systemctl restart clagd.service |
3.7.8-3.7.15 | 3.7.16 |
| 2553887 |
When using TACACS+ configured with a DEFAULT user providing privilege level lower than 16, TACACS+ configured users with privilege level 16 access might not be able to run privilege level 16 NCLU commands, such as net add and net del and see an error similar to the following:
To work around this issue, remove the DEFAULT user from the TACACS+ server. |
3.7.7-3.7.16, 4.0.0-4.4.5 | |
| 2552739 |
Counters for IPROUTER rules do not increase when traffic is forwarded to the CPU because there is no IP neighbor. | 3.7.2-3.7.16 | |
| 2552528 |
Ingress SPAN/ERSPAN does not mirror packets when the next hop is EVPN encapsulated. | 3.7.7-4.2.1 | 4.3.0-4.4.5 |
| 2551675 |
When you restart clagd, the edge port setting on the peer link changes. |
3.7.2-4.2.0 | 4.2.1-4.4.5 |
| 2551288 |
When you remove BFD configuration by editing the /etc/frr/frr.conf file and restarting FRR, you see a traceback.To work around this issue, either use NCLU or vtysh commands to remove the BFD configuration, or restart FRR with the new /etc/frr/frr.conf file. |
3.7.7-3.7.16 | 4.0.0-4.4.5 |
| 2550600 |
The received PVST BPDU for a VLAN is flooded even though the ingress port doesn’t have the VLAN tagged. | 3.7.8-3.7.14.2, 4.0.0-4.3.0 | 3.7.15-3.7.16, 4.3.1-4.4.5, 4.4.0-4.4.5 |
| 2550478 |
VXLAN interface as in-interface or out-interface in an ACL is not supported in Spectrum-based switches. | 3.7.7-4.2.0 | 4.2.1-4.4.5, 4.3.0-4.4.5 |
| 2550323 |
After a neighbor is removed, the redistributed neighbor entry is withdrawn from the BGP table, but the prefix might still be selected as the bestpath when the host’s originated prefix is not advertised. To work around this issue, recreate the neighbor entry and flap the interface to the host. Or, if the host is already down, manually create a neighbor entry with an invalid MAC address, which forces redistribute neighbor to re-withdraw the entry. |
3.7.3-3.7.16 | 4.0.0-4.4.5 |
| 2548475 |
After you add a new VNI and a layer 3 SVI to a set of leafs, certain leafs might not be able to communicate on the layer 3 VNI. To work around this issue, reboot the leaf switch or restart switchd. |
3.7.6-3.7.16 | 4.0.0-4.4.5 |
| 2548382 |
The QuantaMesh BMS T3048-LY8 switch shows a low fan RPM in syslog. | 3.7.5-3.7.12, 4.0.0-4.1.1 | 3.7.13-3.7.16, 4.2.0-4.4.5 |
| 2548243 |
On switches with the Trident2+ ASIC, adding SPAN rules disables PBR rules. | 3.7.3-3.7.16, 4.0.0-4.4.5 | |
| 2547769 |
syslog might report a high load average with the CPU running a later microcode revision. |
3.7.4-3.7.12 | 3.7.13-3.7.16 |
| 2547663 |
When traffic from a double tag interface (facing a different site) is forwarded through VXLAN, the inner tag is not removed. The destination does not know this tag, so it discards it. | 3.7.8-4.0.1 | 4.1.0-4.4.5 |
| 2547012 |
On the Mellanox Spectrum switch, switchd can sometimes fail when PBR rules are installed or removed from hardware if the rule is setting a next hop learned via a routing protocol. |
3.7.7-3.7.11, 4.0.0-4.0.1 | 3.7.12-3.7.16, 4.1.0-4.4.5 |
| 2546998 |
When you configure Cumulus Linux with a /32 address on a switch port with a configured peer address (for example, to connect to a device using IP unnumbered), the switch sends GARPs for the peer address. | 3.7.5-3.7.11 | 3.7.12-3.7.16, 4.1.0-4.4.5 |
| 2546868 |
Broadcom Field Alert - SID - MMU 2B Errors A few of the MMU memories on Broadcom switches are grouped together with single parity control. During SER correction when a parity error occurs on one of those groups, other memory in that group might also report a SER error. This occurs when the memory is accessed either by a packet hit or through a schan operation. This issue can cause SER errors in other memory and cause traffic mis-forwarding or a packet drop. |
3.7.0-3.7.11, 4.0.0-4.0.1 | 3.7.12-3.7.16, 4.1.0-4.4.5 |
| 2546702 |
The FRR cl-support module times out on switches on the ARM platform even when the switch is not under heavy load. To work around this issue, run the cl-support -M command to disable timeouts. |
3.7.0-3.7.11, 4.0.0-4.0.1 | 3.7.12-3.7.16, 4.1.0-4.4.5 |
| 2546385 |
SNMP ifLastChange reports link transitions when there are none. | 3.7.6-3.7.16 | |
| 2545693 |
On rare occasions, after rebooting the MLAG secondary switch, one MLAG device might see the peer as down, which can cause traffic disruption to connected hosts. | 3.7.7-3.7.10 | 3.7.11-3.7.16, 4.1.0-4.4.5 |
| 2545599 |
IPv6 table rules might affect forwarding. For example, if you create the following rule in the /etc/cumulus/acl/policy.d/03-sshd.rules file, the rule counter increments but IPv4 SSH traffic might be dropped.
|
3.7.2-3.7.11, 4.0.0-4.0.1 | 3.7.12-3.7.16, 4.1.0-4.4.5 |
| 2545405 |
The ospfd daemon might crash with the following kernel trace:
|
3.7.6-3.7.10 | 3.7.11-3.7.16 |
| 2545235 |
On the Edgecore AS6812 switch, you might see rare I2C errors. | 3.7.2-3.7.10, 4.0.0-4.0.1 | 3.7.11-3.7.16, 4.1.0-4.4.5 |
| 2545132 |
On the Mellanox switch, ACL lookups are performed for VLAN matches when no rules with UNTAGGED match are present. |
3.7.2-3.7.10, 4.0.0-4.0.1 | 3.7.11-3.7.16, 4.1.0-4.4.5 |
| 2545027 |
In the default VRF, VRRP might crash and stay in an initialize state. As a result, VRRP multicast traffic is not generated. | 3.7.8-3.7.10 | 3.7.11-3.7.16 |
| 2544937 |
The neighmgrd service does not ignore neighbors on reserved devices (lo and management devices). This issue is not seen when management VRF is enabled. |
3.7.8-3.7.11 | 3.7.12-3.7.16 |
| 2544846 |
You might experience a bgpd memory usage increase and significant update exchanges due to host moves between VTEPs. |
3.7.7-3.7.10, 4.0.0-4.0.1 | 3.7.11-3.7.16, 4.1.0-4.4.5 |
| 2544829 |
Frames received with a VLAN tag of 0 on an interface configured as a bridge port and forwarded to the CPU for processing might appear tagged with the native VLAN when viewed with tcpdump. |
3.7.8-3.7.16 | |
| 2544723 |
Setting ProtoDown on ports populated with SFP modules providing RJ-45 1000BASE-T interfaces does not cause the carrier to be dropped. The kernel shows carrier down; however, the remote device still shows a link. | 3.7.6-3.7.10, 4.0.0-4.4.5 | 3.7.11-3.7.16 |
| 2544609 |
BGP is configured with soft reconfiguration-in for its peers, which is not working correctly and causes routes to have an unexpected label. As a result, transit traffic is not forwarded by the switch. | 3.7.7-3.7.16 | 4.0.0-4.4.5 |
| 2544559 |
When you install a large number of new rules with nonatomic mode enabled, there is a chance that you install more rules than the number of available slots in the slice, which results in the slice being completely wiped and reinstalled. This causes a large drop increase, including to cpu0, and might cause a major outage by dropping all BGP sessions. | 3.7.8-3.7.16 | 4.0.0-4.4.5 |
| 2544385 |
The QCT QuantaMesh BMS T7032-IX7 switch may report “failed to request GPIO pin” errors during the boot up. | 3.7.5-3.7.10 | 3.7.11-3.7.16 |
| 2544311 |
Applying a policy-based routing (PBR) rule for all traffic from a host might disrupt ARP refresh for that connected host. | 3.7.5-3.7.16, 4.0.0-4.4.5 | |
| 2544212 |
Cumulus Linux poed generates excessive debug log entries. These will be reduced in a future release. | 3.7.3-3.7.10, 4.0.0-4.0.1 | 3.7.11-3.7.16, 4.1.0-4.4.5 |
| 2544155 |
NCLU requires you to specify an interface with multiple address-virtual statements in ascending MAC address order. |
3.7.5-3.7.16, 4.0.0-4.4.5 | |
| 2544012 |
After you remove a subinterface, the BGP session stays in a Connect state. | 3.7.8-3.7.11 | 3.7.12-3.7.16 |
| 2543937 |
An interface alias configured outside FRR using iproute2 is imported into the FRR running configuration and overrides the internal description. After an FRR reload, this causes FRR to delete the interface alias in an inefficient way. Depending on how many interfaces with aliases you have configured, this can cause a FRR reload to time out.To work around this issue, remove the interface alias description from iproute2. |
3.7.8-3.7.10, 4.0.0-4.4.5 | 3.7.11-3.7.16 |
| 2543900 |
On the Mellanox switch, static VXLAN tunnels incorrectly allow traffic from any remote tunnel IP address. | 3.7.8-3.7.16, 4.0.0-4.4.5 | |
| 2543875 |
On the Mellanox Spectrum switch, a route withdrawal might cause the associated next hop neighbor entry to be deleted in hardware but remain in the kernel. This can cause traffic going through the directly connected route to the removed neighbor entry to be forwarded to the CPU. | 3.7.6-3.7.16 | 4.0.0-4.4.5 |
| 2543841 |
The net show evpn vni detail json command includes an extra empty dictionary at the end of the output. |
3.7.8-3.7.16, 4.0.0-4.4.5 | |
| 2543840 |
On the Mellanox SN2700 switch, you cannot enable resilient hashing (RASH) and set the bucket size to 64 in the traffic.conf file. |
3.7.6-3.7.16 | |
| 2543816 |
On the Dell S5248F-ON switch, smond might generate syslog messages indicating that the fan input RPM is lower than the normal low speed of 2500 RPM. Speeds as low as 1700 RPM are acceptable in normal thermal environments; therefore, you can ignore these messages. |
3.7.6-3.7.11, 4.0.0-4.4.5 | 3.7.12-3.7.16 |
| 2543800 |
When local-tunnelip is an SVI, the static VXLAN tunnel does not work; the next hop router receives the packet but drops it as it does not know where to forward the packet. The static VXLAN tunnel does works if local-tunnelip is a loopback or a physical layer 3 interface. |
3.7.8-3.7.16 | 4.0.0-4.4.5 |
| 2543781 |
NCLU does not allow you to configure OSPF NSSAs. For example:
To work around this issue, use FRR instead. For example:
|
3.7.7-3.7.10, 4.0.0-4.4.5 | 3.7.11-3.7.16 |
| 2543727 |
ACL rules, such as the following, fail to install if you use swp+ (interfaces mentioned as wildcards).
You can now install such rules with swp+. |
3.7.3-3.7.16 | 4.0.0-4.4.5 |
| 2543724 |
If a hostname contains utf-8 characters, the NCLU net show lldp command outputs the following error:
|
3.7.7-3.7.10, 4.0.0-4.4.5 | 3.7.11-3.7.16 |
| 2543689 |
On the Mellanox switch, UFT profiles are unable to support the documented capacity for routes to addresses that are more than 64 bits in length. The listed capacities assume 64-bit destination IP addresses. | 3.7.8-3.7.10, 4.0.0-4.0.1 | 3.7.11-3.7.16, 4.1.0-4.4.5 |
| 2543667 |
On the EdgeCore AS4610 switch, the ping command fails unless you run the command with sudo. To work around this issue, run the following commands:
Run the following command to verify the workaround:
You should see the following output:
|
3.7.6-3.7.10, 4.1.0-4.1.1 | 3.7.11-3.7.16, 4.2.0-4.4.5 |
| 2543665 |
clagd memory consumption increases under certain unknown conditions. |
3.7.8-3.7.16 | 4.0.0-4.4.5 |
| 2543648 |
You cannot specify a source and destination MAC address in an ERSPAN ebtables rule. For example, the following rule does not work:
|
3.7.6-3.7.12, 4.0.0-4.1.1 | 3.7.13-3.7.16, 4.2.0-4.4.5 |
| 2543647 |
ERSPAN in ebtables does not work for VNIs. For example, the following rule does not work:
|
3.7.6-4.2.1 | 4.3.0-4.4.5 |
| 2543646 |
In an ebtables rule, ERSPAN (upper case) does not work. You need to specify erspan (lower case). | 3.7.6-3.7.16, 4.0.0-4.4.5 | |
| 2543627 |
Tomahawk 40G DACs cannot disable auto-negotiation. | 3.7.7-3.7.16 | 4.0.0-4.4.5 |
| 2543546 |
{watchfrr calls sudo /usr/sbin/service frr restart bgpd but restarts all FRR daemons which can cause a large outage. This occurs because watchfrr uses an old style service command, which causes all daemons to restart when a daemon fails. |
3.7.7-3.7.8 | 3.7.9-3.7.16 |
| 2543473 |
Configuring an inbound route map to manually change the next hop IP address received from an eBGP peer locally causes the next hop to not be updated when advertising this route out to other eBGP peers. To work around this issue, set a “dummy” route map outbound to the eBGP peer or configure the route map to manually set the next hop outbound from the originating eBGP peer. | 3.7.6-3.7.10 | 3.7.11-3.7.16 |
| 2543472 |
On switches with the Spectrum ASIC, the underlay hashes VXLAN packets for a given overlay flow randomly. To work around this issue, configure the ECMP hash seed to the same value on the EVPN egress leaf switches. |
3.7.7-4.0.1 | 4.1.0-4.4.5 |
| 2543469 |
When using the UFT lpm-equal profile, IPv6 routes are limited to 16K. | 3.7.8 | 3.7.9-3.7.16 |
| 2543389 |
Dynamic route-leaking works as expected until FRR is restarted or the switch is rebooted. After the restart or reboot, the import RT under the VRF where routes are being imported is incorrect. | 3.7.7-3.7.8 | 3.7.9-3.7.16 |
| 2543374 |
After a remote VTEP peer link goes down, the tunnel destination IP address might be incorrect in hardware, which might cause loss of overlay communication between VTEPs. | 3.7.8-3.7.16 | 4.0.0-4.4.5 |
| 2543325 |
Lenovo switches do not send or receive LLDP on eth0 interfaces. | 3.7.7-3.7.16 | 4.0.0-4.4.5 |
| 2543270 |
The default route injected through OSPF when you configure default-information originate always is unreliable and might age out unexpectedly.To work around this issue, rely on a different source of default route other than injection with default-information originate. |
3.7.8-4.1.1 | 4.2.0-4.4.5 |
| 2543211 |
In some cases, the switchd service might warn of excessive MAC moves from one switch port to itself (for example, from swp18 to swp18). |
3.7.0-3.7.16, 4.0.0-4.4.5 | |
| 2543164 |
The MTU of an SVI cannot be higher than the MTU on the bridge. Changing the MTU on the SVI with NCLU does not update the bridge MTU. The net commit command succeeds even though the MTU is not changed as expected.To work around this issue, change the MTU on all SVIs and the bridge manually in the /etc/network/interfaces file, then apply the change with the ifreload -a command. |
3.7.7-3.7.16, 4.0.0-4.4.5 | |
| 2543113 |
NCLU restarts FRR when attempting to remove a BGP VRF stanza. This happens regardless of whether the VRF is valid/configured elsewhere on the switch or the removal is successful. To work around this issue, remove the stanza using vtysh. |
3.7.3-3.7.16 | 4.0.0-4.4.5 |
| 2543096 |
When an SVI with a virtual MAC is configured with a layer 2 VNI in an EVPN environment, if you replace the /etc/network/interfaces file with a different file that does not have the SVI and layer 2 VNI configuration, the original virtual MAC is not populated through the EVPN route until FRR is restarted. |
3.7.6-3.7.16, 4.0.0-4.4.5 | |
| 2543058 |
The IP neighbor entry for a link-local next hop is not installed by FRR, which results in a forwarding failure for routes via that next hop. This is a rare problem that occurs with IPv4 route exchange over IPv6 GUA peering with no IPv4 addresses on the interfaces. To work around this issue, flap the peering to the peer router (which might be a route reflector) to recover. To avoid this issue, configure IPv6 router advertisements on the connecting interfaces. |
3.7.7-3.7.16 | 4.0.0-4.4.5 |
| 2543052 |
Received EVPN type-5 and type-2 MACIP routes are not installed in the kernel (and hardware) routing tables for the associated VRF, which causes traffic to be blackholed. The failure to install the default route causes complete reachability failure for the particular tenant on the affected racks. The routes that are not installed are seen as “inactive” in the routing subsystem (FRR) VRF routing table. This problem is rare and can occur only in EVPN configurations that have user-configured route targets (RTs) for tenant VRFs, and only following a restart of FRR. To work around this issue, either restart the FRR service on the affected switch with the sudo systemctl restart frr.service command or bounce the layer 3 SVI for the affected VRF; for example:
You can run the net show vrf vni command to print a mapping of VRF : L3-VNI : L3-SVI. |
3.7.5-3.7.16 | 4.0.0-4.4.5 |
| 2543044 |
Under certain conditions, EVPN next hops might not be removed when the contributing peer goes down or might not be populated when the BGP session to the contributing peer comes up. You can prevent EVPN next hops from not being removed when the contributing peer goes down by specifying static MAC addresses on all layer 3 VNIs. There is no workaround for preventing EVPN next hops from not being populated when the BGP session to the contributing peer comes up. |
3.7.2-3.7.16 | 4.0.0-4.4.5 |
| 2543004 |
Cumulus Linux installer images have a shell script that validates checksum integrity. When you run onie-install, this check is run but the installer is still staged even if the checksum validation fails. To work around this issue, perform your own checksum validation before staging a new image with onie-install. |
3.7.7-3.7.8 | 3.7.9-3.7.16 |
| 2542985 |
On a Tomahawk switch, the 5m 40G DACs (40G CR4) do not come up when both sides have auto-negotiation enabled. | 3.7.7-3.7.8 | 3.7.9-3.7.16 |
| 2542979 |
On the Dell-N3048EP-ON switch, when you run the sudo -E apt upgrade command, the upgrade does not work. |
3.7.7-4.1.1 | 4.2.0-4.4.5 |
| 2542958 |
When transitioning from a down state to an up state due to peerlink failure and recovery, MLAG does not start the initDelay timer before trying to bring everything back up. | 3.7.7-3.7.16 | 4.0.0-4.4.5 |
| 2542945 |
On the Broadcom Maverick switch with a QinQ configuration, the packets coming into the CPU might be tagged incorrectly; for example, 802.1ad + 802.1q tags are expected in the packets but the packets have 802.1q + 802.1q tags. To work around this issue, configure the bridge with bridge-vlan-protocol 802.1ad:
|
3.7.6-3.7.16, 4.0.0-4.4.5 | |
| 2542938 |
When MLAG is re-establishing its peering after a member reboot, the VNIs on the peer briefly go into a protodown state. This can cause complete downtime to dually connected hosts as the member coming back up is still in initDelay. This issue does resolve itself as the VNIs do come back up within ten seconds. |
3.7.8 | 3.7.9-3.7.16, 4.0.0-4.4.5 |
| 2542913 |
IF-MIB::ifHCInOctets reports significantly lower values than reported by interface counters seen elsewhere. | 3.7.6-3.7.16 | 4.0.0-4.4.5 |
| 2542871 |
After you issue the NCLU net del bgp vrf command and commit the change, Cumulus Linux does not remove the configuration from the /etc/frr/frr.conf file or the net show config commands. |
3.7.3-3.7.10, 4.0.0-4.0.1 | 3.7.11-3.7.16, 4.1.0-4.4.5 |
| 2542853 |
For interfaces configured with RS FEC, when switchd is restarted, the link goes down but does not automatically come back up. This occurs because the FEC status is not replayed correctly into the kernel. To work around this issue, run the ifreload -a command to bring up the interface after switchd is restarted. |
3.7.6-3.7.8 | 3.7.9-3.7.16 |
| 2542837 |
On Mellanox switches, policer iptables are not working as expected. For example, when using a policer with mode KB/MB/GB to rate-limit interfaces, the syntax is accepted but the data plane transfer speed is not affected by the rule. | 3.7.6-3.7.8, 4.0.0-4.4.5 | 3.7.9-3.7.16 |
| 2542835 |
snmpd fails because NCLU does not remove agentaddress @vrf lines when running the net add snmp-server listening-address all command. |
3.7.4-3.7.16 | 4.0.0-4.4.5 |
| 2542823 |
On the Broadcom Trident 3 switch, VXLAN encapsulated packets are dropped on the ingress port (tagged layer 2 port) during transit forwarding (the local switch does not terminate the VXLAN tunnel). An example of where this two-layer VXLAN inside VXLAN encapsulation might occur: - VXLAN tunnel (#1) between two servers (different racks) to provide layer 2 extension for containers or VM hosts. - VXLAN tunnel (#2) between the TOR switch in rack 1 to the TOR switch located in the remote rack. To work around this issue, either: - Configure the edge port (facing the servers) to be an access port (instead of a trunk/tagged port) - Change the destination port from 4789 to something else (VXLAN tunnel terminated by the servers) |
3.7.5-3.7.11, 4.0.0-4.0.1 | 3.7.12-3.7.16, 4.1.0-4.4.5 |
| 2542819 |
On the Trident3 platform, you can only add 50 percent of the total ECMP next hops. A log message indicates that the table is full. | 3.7.7-3.7.8 | 3.7.9-3.7.16, 4.0.0-4.4.5 |
| 2542774 |
When moving an IP address from the address line to inet dhcp, then issuing the ifreload -a command, the old address is not removed from the interface. NCLU still reports the old address only and reports it as a DHCP address. |
3.7.6-3.7.8 | 3.7.9-3.7.16 |
| 2542767 |
If the BMC operating system fails to respond to IPMI, you see a traceback in bmcd and all the sensors might report ABSENT devices in smonctl. To work around this issue, power cycle the switch. |
3.7.6-4.0.1 | 4.1.0-4.4.5 |
| 2542765 |
When you configure the switch to send an EAP request with the net add dot1x send-eap-request-id command, the switch ignores re-authentication attempts and does not send back an EAPol. |
3.7.6-3.7.10 | 3.7.11-3.7.16 |
| 2542726 |
After configuring switchd hal.bcm.per_vlan_router_mac_lookup to TRUE on a Broadcom switch, layer 2 traffic works over VXLAN but the host is not able to ping the locally connected gateway and loses routing ability to other IPs and subnets. |
3.7.5-3.7.8 | 3.7.9-3.7.16 |
| 2542711 |
BGP update packets are sometimes missing the mandatory nexthop attribute, which causes connections to reset. For example, this issue is seen when using VRF route leaking with a mix of BGP unnumbered and BGP numbered peers. |
3.7.6-3.7.8 | 3.7.9-3.7.16 |
| 2542509 |
In EVPN symmetric or centralized configurations with BGP peering over a peer link, VXLAN routed packets transiting an MLAG peer are dropped until the clagd init-delay timer expires during the bring-up sequence following a reboot.The problem is caused by a race condition when programming the anycast IP address (used to terminate VXLAN tunnels), where the hardware is programmed before the software by clagd.To work around this issue, configure the BGP path across the peer link to be less preferred. The example below uses AS path prepending and the MLAG switches are iBGP neighbors. However, other BGP configurations achieve the same result. In the /etc/frr/frr.conf file, make a new AS path access list and route map to apply BGP pre-pending of the local ASN one or more times. For example:
|
3.7.6-3.7.10, 4.0.0-4.0.1 | 3.7.11-3.7.16, 4.1.0-4.4.5 |
| 2542480 |
When BGP remove-private-AS replace-AS is configured under the BGP IPv4 or IPv6 address family between a pair of switches configured as BGP peers, a BGP route update might cause the BGP session to flap. To work around this issue, do not configure remove-private-AS replace-AS in the BGP IPv4 or IPv6 address family. |
3.7.6-3.7.8 | 3.7.9-3.7.16 |
| 2542384 |
When you define a trap destination using @mgmt, snmpd indicates that the network is unreachable even though the IP address is reachable in the management VRF. To work around this issue, remove @mgmt vrf references in the /etc/snmp/snmpd.conf file, stop snmpd, then start snmpd manually in the management VRF with the systemctl start snmpd@mgmt command. |
3.7.6-3.7.16 | 4.0.0-4.4.5 |
| 2542365 |
The snmpd service frequently crashes due to double free or corruption. |
3.7.6-3.7.8 | 3.7.9-3.7.16 |
| 2542341 |
The IP neighbor entry for a link-local next hop (169.254.x.x) is not installed by FRR, which results in a forwarding failure for routes via that next hop. This is a rare problem that occurs with IPv4 route exchange over IPv6 GUA peering with no IPv4 addresses on the interfaces. To work around this issue, flap the peering to the peer router (which can be a route reflector) to recover. To avoid this issue, configure IPv6 router advertisements on the connecting interfaces. |
3.7.7-3.7.8 | 3.7.9-3.7.16 |
| 2542336 |
On the Mellanox SN2410 switch, switchd does not start. |
3.7.2-3.7.8 | 3.7.9-3.7.16 |
| 2542310 |
hsflow disregards the setting for agent.cidr in the /etc/hsflowd.conf file and selects an IPv6 agent address. The source IP address of the hsflowd packet is IPv4, but the agent address in the hsflow payload shows IPv6. |
3.7.6-3.7.16 | |
| 2542305 |
If an SVI exists in the configuration before you assign it an IP address, when you do assign the IP address with the NCLU command, the vlan-id and the raw-device bridge stanzas are not added automatically. |
3.7.6-3.7.16, 4.0.0-4.4.5 | |
| 2542301 |
When first creating a bond and enslaving an interface, NCLU hides some of the bridge command suggestions, although they are still accepted. |
3.7.3-3.7.16, 4.0.0-4.4.5 | |
| 2542297 |
When you run the NCLU net del all command, the exec-timeout setting changes in the /etc/frr.frr.conf file. |
3.7.6-3.7.8 | 3.7.9-3.7.16 |
| 2542248 |
When you generate a cl-support file, clagd.service prints log messages similar to the following:
|
3.7.6-3.7.16 | 4.0.0-4.4.5 |
| 2542193 |
When you configure the link-down yes attribute to a physical SVI, the VRR (-v0) interface is not brought down, and the locally-connected subnet can still be redistributed into routing protocols and advertised to neighbors despite the physical SVI being administratively down. To work around this issue, manually bring down the VRR (-v0) interface with the ip link set dev command. For example:
|
3.7.6-3.7.8 | 3.7.9-3.7.16 |
| 2542058 |
The ifquery command should return a non-zero value if there is a syntax error. However, it currently returns zero. This issue affects automation scripts that validate a file before copying it into place. |
3.7.6-3.7.8 | 3.7.9-3.7.16 |
| 2542031 |
If you configure a sys-mac with a single digit, ifreload -a does not indicate that the MAC address is invalid for the MLAG sys-mac and the clagd process fails silently. |
3.7.6-3.7.8 | 3.7.9-3.7.16 |
| 2541924 |
If the address-virtual MAC address is missing a leading zero in the last octet, the interface bounces. |
3.7.6-3.7.8 | 3.7.9-3.7.16 |
| 2541604 |
The snmpd service exits with a message similar to the following:
This problem might occur during or after network convergence events. For example, when bgpd needs to process a high number of updates and the CPU cannot keep up, bgpd is disconnected and agentx generates a core dump in snmpd due to a memory allocation problem. To work around this issue, disable agentx by commenting out the following lines in the /etc/snmp/snmpd.conf file. Then, restart the snmpd service with the systemctl restart snmpd command.
If you still want to poll the BGP4-MIB information, re-enable the bgp pass persist script by adding the following line in the /etc/snmp/snmpd.conf file:
|
3.7.2-3.7.8 | 3.7.9-3.7.16 |
| 2541212 |
The maximum-prefix configuration under the IPv4 address family has an optional restart value, which you can configure. This configuration is ignored and, instead of restarting the sessions every x minutes, the peer constantly changes between established and idle due to the prefix count being exceeded. |
3.7.5-3.7.16, 4.0.0-4.4.5 | |
| 2541165 |
On the Dell N3048EP-ON switch, UPOE is supported only on ports 1 thru 12. (UPOE uses all four pairs of standard Ethernet cabling whereas PoE delivers power over two twisted pairs.) When you plug a UPOE device in a port higher than port 12, poectl reports that four_pair_mode_enabled is true. However, this configuration is not supported on the port so poectl should report that four_pair_mode_enabled is false. |
3.7.6-3.7.16 | |
| 2541029 |
On switches with the Trident2 ASIC, 802.1Q-encapsulated control plane traffic received on an interface with 802.1AD configured subinterfaces might be dropped. This issue only affects QinQ configurations. |
3.7.5-3.7.16, 4.0.0-4.4.5 | |
| 2541003 |
NCLU is unable to delete a BGP neighbor configuration if there is a VRF VNI mapping in the /etc/frr/frr.conf file. For example, the following NCLU command produces an error:
|
3.7.7-3.7.8 | 3.7.9-3.7.16, 4.0.0-4.4.5 |
| 2540950 |
On the QuantaMesh T4048-IX8 or EdgeCore AS7326-56X switch, when using a 1000BASE-T SFP module, the module LEDs do not light to reflect link status. |
3.7.3-4.1.1 | 4.2.0-4.4.5 |
| 2540885 |
The Dell N3048EP-ON switch does not support 1G Base-T modules in the SFP ports. | 3.7.7-3.7.16 | |
| 2540863 |
On the EdgeCore AS5812-54X switch, the PSU2 Fan1 fluctuates between OK and LOW. When the fan speed is reported as LOW, the RPM is shown as a negative number. |
3.7.3-3.7.16 | |
| 2540753 |
If the interface alias contains a single or double quotation mark, or an apostrophe, the net show configuration commands fail with the following error:
|
3.7.5-3.7.16, 4.0.0-4.4.5 | |
| 2540684 |
On a Dell S5248F (Trident3) switch, packets from switch ports are forwarded to the CPU and are sometimes corrupted. The corruption might result in BGP peerings being down, which can lead to all VXLAN traffic to and from a node to be lost, causing an outage to dually connected hosts in a rack. To work around this issue, restart switchd. |
3.7.3-3.7.8 | 3.7.9-3.7.16, 4.0.0-4.4.5 |
| 2540600 |
If the clagd-vxlan-anycast-ip is removed from the /etc/network/interfaces file (either with the NCLU command or by editing the file manually), MLAG still believes it is present until clagd restarts. |
3.7.3-3.7.8 | 3.7.9-3.7.16, 4.0.0-4.4.5 |
| 2540444 |
SNMP incorrectly requires engine ID specification. |
3.7.4-3.7.16, 4.0.0-4.4.5 | |
| 2540359 |
bgpd creates a core dump at zclient_send_interface_radv_req. This is an issue with how FRRouting checks next hops and has been pushed upstream to FRRouting. |
3.7.6-3.7.8 | 3.7.9-3.7.16 |
| 2540352 |
When you use NCLU to configure a route map, the parser allows for glob matching of interfaces for a match interface condition when there can only be a single interface matched. The proper syntax is to use multiple route map clauses, each matching a single interface, instead of a single clause matching multiple interfaces. For example, this command is incorrect:
These commands are correct:
|
3.7.2-3.7.16, 4.0.0-4.4.5 | |
| 2540340 |
NCLU allows for the configuration of addresses on VRF interfaces, but tab completion for the net add vrf command just displays
Tab completion for the net add vrf command works correctly. |
3.7.4-3.7.16, 4.0.0-4.4.5 | |
| 2540274 |
On the Maverick switch, CPU forwarded packets might be dropped when there is no route to a leaked host route. | 3.7.5-3.7.16, 4.0.0-4.4.5 | |
| 2540204 |
When links come up after FRR is started, VRF connected routes do not get redistributed. | 3.7.4-3.7.16, 4.0.0-4.4.5 | |
| 2540192 |
The net del bridge bridge mcsnoop yes command does not return the value to the default of disabled. To work around this issue, use the net add bridge bridge mcsnoop no command to delete the mcsnoop attribute and return to the default value. |
3.7.4-3.7.16, 4.0.0-4.4.5 | |
| 2540155 |
On the Broadcom switch, when moving configuration from bridged to routed (or toggling from routed to bridged to routed), some traffic is not seen by the kernel. This can cause BGP to not establish on a transit node. |
3.7.3-3.7.16, 4.0.0-4.4.5 | |
| 2540042 |
When you try to configure the VRRP priority and advertisement-interval with NCLU on a traditional mode bridge, the net commit command fails. To work around this issue, use the vtysh command (inside FRR) to change the VRRP priority or advertisement-interval on traditional bridges. For example:
|
3.7.4-3.7.16, 4.0.0-4.4.5 | |
| 2540041 |
On SVIs in a VLAN-aware bridge, you cannot change the VRRP priority with NCLU. To work around this issue, run the vtysh command inside FRR to change the default priority. For example:
|
3.7.4-3.7.16, 4.0.0-4.4.5 | |
| 2540040 |
Cumulus Linux uses VRRPv3 as the default version, and enables both preempt and accept mode by default. You cannot change these default values with NCLU. To work around this issue, run the vtysh commands (inside FRR) to change the default values. For example:
|
3.7.4-3.7.16, 4.0.0-4.4.5 | |
| 2540031 |
NCLU does not honor auto all in the /etc/network/interfaces file and removes the existing configuration if no individual auto lines exist. |
3.7.3-3.7.16, 4.0.0-4.4.5 | |
| 2539994 |
When you try to remove a BGP peer group configuration with NCLU, the command fails but no warning message is shown. For example:
|
3.7.2-3.7.16, 4.0.0-4.4.5 | |
| 2539962 |
When an LDAP user that does not have NCLU privileges (either in the netshow or netedit group, or in the /etc/netd.conf file) runs an NCLU command, a traceback occurs instead of a permissions error. |
3.7.0-3.7.16, 4.0.0-4.4.5 | |
| 2539670 |
On the Edgecore 4610-54P switch, automatic medium-dependent interface crossover (auto-MDIX) stops working on a 100M full duplex interface and does not detect the required cable connection type. |
3.7.2-3.7.16, 4.0.0-4.4.5 | |
| 2539124 |
The net add interface command adds no ptm-enable for that interface in the frr.conf file. Running the net add or the net del command does not remove no ptm-enable from the frr.conf file. You have to remove it manually using vtysh. |
3.7.2-3.7.16, 4.0.0-4.4.5 | |
| 2539081 |
When you delete post-up and pre-down IP peer entries from the etc/network/interfaces file, then run the ifreload command, the IP addresses are not removed and the route remains in the route table. To work around this issue, either delete the IP addresses without the /32 mask component or flush the IP addresses for the interface with the ip addr flush dev command. |
3.7.0-3.7.16 | 4.0.0-4.4.5 |
| 2538875 |
IPv6 multicast traffic destined to an unregistered multicast group is flooded to all ports in a bridge despite the bridge.optimized_mcast_flood = TRUE setting in the /etc/cumulus/swichd.conf file. |
3.7.2-3.7.16 | |
| 2538790 |
NCLU automatically adds the VLAN ID (for the layer 3 VNI/SVI) to the bridge when you run net add vxlan . This configuration breaks network connectivity in an EVPN symmetric routing configuration using MLAG. To restore connectivity, remove the VLAN ID from the bridge. |
3.7.2-3.7.16, 4.0.0-4.4.5 | |
| 2538741 |
The NCLU command net show bridge spanning-tree does not show the MLAG peer link as part of the STP forwarding instance.To work around this issue, use the mstpctl command to confirm the STP status of the port. |
3.7.2-3.7.8 | 3.7.9-3.7.16 |
| 2538590 |
When you configure a control plane ACL to define permit and deny rules destined to the local switch, NCLU programs the control plane ACL rules into the FORWARD chain. |
3.7.2-3.7.16, 4.0.0-4.4.5 | |
| 2538562 |
On an RMP/1G-T switch, when you remove link-speed 100 with the NCLU command or by editing the etc/network/interfaces file to revert the 100M interface to the default (1G auto), the interface fails to recover and does not come back up.After you remove the link-speed, ethtool shows the advertised link modes as not reported and Speed/Duplex as unknown.To work around this issue and bring the interface back up, either restart switchd or use ethtool to configure the speed, advertised, duplex or MDI-X settings. Note: The advertised link mode gets set incorrectly if you include 1000baseT/Half. The port will come up successfully at 1G. |
3.7.2-3.7.16, 4.0.0-4.4.5 | |
| 2538480 |
Modifying the /etc/netd.conf file to set show_linux_command = True does not take effect. |
3.7.2-3.7.8 | 3.7.9-3.7.16 |
| 2538302 |
portwd allows an error to change the module type based on the error. For example, a bad write to a module might cause the module type to flap, which causes the link itself to flap. |
3.7.0-3.7.16 | |
| 2538294 |
If you use NCLU to create an iBGP peering across the peer link, running the net add bgp l2vpn evpn neighbor peerlink.4094 activate command creates a new eBGP neighborship when one has already been configured for iBGP. This is unexpected; the existing iBGP configuration is valid. |
3.7.0-3.7.16, 4.0.0-4.4.5 | |
| 2538256 |
On the Broadcom switch, when a link-local multicast frame is received on an access port with a VNI in the bridge, two copies of the packet are sent across the VNI to remote VTEPs and the receiving hosts observe duplicate packets. |
3.7.2-4.0.1 | 4.1.0-4.4.5 |
| 2538022 |
When you remove an interface from a bridge and add it to a VRF in the same commit/ifreload, the IPv6 link-local address is not created automatically. To work around this issue, do the change in two separate commits. First, remove the interface from the bridge, which causes it to be a layer 2 interface. Then, enslave the interface to the VRF. |
3.7.2-3.7.8 | 3.7.9-3.7.16 |
| 2537819 |
When you enable FEC (RS or BaseR) on an interface, removing the configuration from that interface does not revert the FEC status to off/none. |
3.7.2-3.7.16 | 4.0.0-4.4.5 |
| 2537699 |
There is a limitation on the number of SVI interfaces you can specify as DHCP relay interfaces in the /etc/default/isc-dhcp-relay file. For example, 1500 SVI interfaces causes the dhcrelay service to exit without a core file and logs similar to the following are generated for the interfaces:
Eventually the dhcrelay service stops. |
3.7.1-3.7.16, 4.0.0-4.4.5 | |
| 2537544 |
When you run the mstpctl command, you might see the bridge-port state as blocking when it is actually disabled. You might see the same incorrect bridge-port state when other programs or tools use the output of mstpctl; for example, SNMP output from the BRIDGE-MIB. |
3.7.1-3.7.16, 4.0.0-4.4.5 | |
| 2537536 |
When FRR restarts, snmp[err] dev/kmem: Permission denied error messages are recorded in the log file and SNMPd might crash periodically. |
3.7.5-3.7.16 | 4.0.0-4.4.5 |
| 2537378 |
NCLU SNMPv3 user configuration (add, delete, modify) does not complete. Changes are made to the /etc/snmp/snmpd.conf file but the SNMPv3 user cache file /var/lib/snmp/snmpd.conf fails to update correctly and the configuration does not reflect in operation. To work around this issue, stop snmpd, remove the cache file, then restart snmpd. |
3.7.1-3.7.16 | |
| 2537188 |
When an event in the network, such as a switchd or networking service restart, leads to an OVSDB server high availability transition, an ovs-vtepd core might occur. This core generation has no effect on the functionality of high availability when the active OVSDB server is back in the network. |
3.7.2-3.7.16 | |
| 2537153 |
In rare cases, certain IPv6 BGP peers fail to reestablish after switchd restarts. |
3.7.2-3.7.8 | 3.7.9-3.7.16 |
| 2537104 |
When you try to stop hsflowd on the Trident II+ switch with the systemctl stop hsflowd command, the process hangs until you stop it with SIGKILL. |
3.7.1-3.7.16 | 4.0.0-4.4.5 |
| 2537061 |
The Dell S5048F-ON switch (with reverse airflow, rear to front), shows the Temp-3 sensor as absent. |
3.7.1-4.0.1 | 4.1.0-4.4.5 |
| 2536650 |
Mellanox Spectrum and Helix4 switches occasionally send malformed packets and do not send any flow samples (only counters). While this issue is fixed for switches with the Spectrum ASIC, this is a [known limitation|https://docs.cumulusnetworks.com/cumulus-linux/Monitoring-and-Troubleshooting/Network-Troubleshooting/Monitoring-System-Statistics-and-Network-Traffic-with-sFlow/#caveats-and-errata] on this Helix4 platform. |
3.7.0-3.7.8 | 3.7.9-3.7.16, 4.0.0-4.4.5 |
| 2536639 |
On a Dell S4048 switch, when you set the eth0 speed to 100, either with NCLU or by editing the /etc/network/interfaces file, the igb driver crashes, which brings down eth0. To work around this issue: * If eth0 is configured in the management VRF, power cycle the switch; the eth0 configuration fails and reverts back to the default (auto-negotiation/1000). * If eth0 is configured in the default VRF and you power cycle after the crash, igb continues to crash on boot up (before getting to login prompt); power-cycle the switch, select the Advanced option in GRUB to boot to recovery mode, then modify the /etc/network/interfaces file. |
3.7.0-3.7.16 | 4.0.0-4.4.5 |
| 2536608 |
Single tagged ARP requests received on a QinQ-over-VXLAN access port are dropped if ARP suppression is enabled on an unrelated VNI. |
3.7.0-3.7.16 | |
| 2536559 |
When deleting an interface using NCLU, if the /etc/network/interfaces alias is different than the /etc/frr/frr.conf description, the net commit command returns the following error:
Despite this error, the change is made and the description is removed from the frr.conf file. |
3.7.3-3.7.10 | 3.7.11-3.7.16 |
| 2536384 |
The BFD packet redirection logic used by OVSDB server high availability mode redirects BUM packets across the peer link. The iptables rule for redirection does differentiate between BFD and non-BFD VXLAN inner packets because the service node sends all frames with its own IP address as the tunnel source IP address. The VXLAN encapsulated BUM packets do not get forwarded to the CPU and do not go through the iptable redirection rule; only VXLAN encapsulated BFD packets get forwarded to the CPU due to the inner MAC DA lookup in hardware. |
3.7.0-3.7.16, 4.0.0-4.4.5 | |
| 2536230 |
On the Broadcom switch with the Trident3 ASIC, the ECN-CE bit is set by default on transit traffic. This might result in hosts adjusting traffic behavior if they are configured for the ECN feature. In Cumulus Linux 3.7.11, the default behavior changed; the ECN-CE bit is no longer set by default on transit traffic. |
3.7.3-3.7.10, 4.0.0-4.0.1 | 3.7.11-3.7.16, 4.1.0-4.4.5 |
| 2536179 |
On switches with the Trident 2+ ASIC, counters associated with VLANs and VRFs are not working. | 3.7.0-3.7.16, 4.0.0-4.4.5 | |
| 2535986 |
At a high CPU transmit traffic rate (for example, if there is unexpected CPU generated flooding or replication in software), when the ASIC packet driver cannot keep up with the transmit rate because there are no free DMA buffers, it can back pressure by suspending the switch port transmit queues. This can fill up the application socket buffers resulting in No buffer space available error messages on protocol sockets.When the driver recovers, it automatically resumes the transmit queues. In most cases these error messages are transient. In rare cases, the hardware queues might get stuck, which you can recover with a switchd restart. |
3.7.0-3.7.16, 4.0.0-4.4.5 | |
| 2535965 |
On the Trident3 switch, static PIM with IIF based on a layer 2 bridge does not work reliably. PIM Join via signaling is required for IPMC to work properly. To work around this issue, use dynamic signaling (joins) to manage IP multicast traffic. |
3.7.0-3.7.16, 4.0.0-4.4.5 | |
| 2535209 |
The net show lldp command sometimes shows the port description in the Remote Port field. The net show interface command shows the correct value in the Remote Host field.To work around this issue, use net show interface command for LLDP output when connected to Cisco equipment. |
3.7.5-3.7.10, 4.0.0-4.4.5 | 3.7.11-3.7.16 |
| 2534450 |
The default BGP instance must be provisioned and always exist for proper operation of dynamic leaking of routes between VRFs. | 3.7.0-3.7.16 | 4.0.0-4.4.5 |
| 2528990 |
During a link flap test, you might occasionally see a message similar to: warning: swp6: netlink: cannot set link swp6 down: [Errno 98] Address already in use. |
3.7.6-3.7.10 | 3.7.11-3.7.16 |
Fixed Issues in 3.7.8
| Issue ID | Description | Affects |
|---|---|---|
| 2543061 |
When you run the hostnamectl status command or start the systemd-hostnamed process, you see constant unregister_netdevice kernel messages in syslog and on the console. This causes syslog to become filled with these messages and makes troubleshooting difficult. |
3.7.7 |
3.7.7 Release Notes
Open Issues in 3.7.7
| Issue ID | Description | Affects | Fixed |
|---|---|---|---|
| 3410952 |
If MLAG is configured but disconnected from an MLAG peer for an extended period of time (days or more), there is a long delay (up to a minute per day) before traffic forwarding stabilizes after the MLAG peer connection re-establishes. | 3.7.0-4.3.1 | 4.3.2-4.4.5, 5.5.0-5.15.0 |
| 3376798 |
On Broadcom switches, Cumulus Linux does not create the hardware bridging domain for a traditional bridge with a VXLAN interface during switchd restart. The /var/log/switchd.log file includes the following exception logs shortly after switchd restarts:switchd[30158]: hal_bcm_l3.c:1617 find_egr_path_if_vxlan_overlay:vxlan overlay : nh PORT: port <#>, vlanMAC learning looks correct, but traffic does not flow as expected. |
3.7.0-4.3.1 | 4.3.2-4.4.5 |
| 3330705 |
When using TACACS+, a TACACS+ server name that returns more than one IP address, such as an IPv6 and IPv4 address, is counted many times against the limit of seven TACACS+ servers, which might cause some of the later listed servers to be ignored as over the limit. To work around this issue, you can set the prefer_ip_version configuration option (the default value is 4) to choose between an IPv4 or IPv6 address if both are present. |
3.7.0-5.3.1 | 5.4.0-5.15.0 |
| 3327477 |
If you use su to change to a user specified through TACACS+, the user becomes the local tacacs0 thru tacacs15 user instead of the named user to run sudo commands. As a result, the named user password might not match the local tacacs0 thru tacacs15 user password. |
3.7.0-3.7.16, 4.0.0-4.4.5, 5.0.0-5.15.0 | |
| 3216921 |
RADIUS authenticated users with read-only access to NCLU commands (users in the users_with_show list) can run edit commands if a username for a non-local account is on the users_with_edit line of the /etc/netd.conf file. To work around this issue, make sure that all usernames on the users_with_edit line of the /etc/netd.conf file are configured local users for the system (real Linux users) |
3.7.0-3.7.16, 4.3.0-4.4.5 | |
| 3209699 |
RADIUS authenticated users with read-only access to NCLU commands (users in the users_with_show list) can run edit commands if a username for a non-local account is on the users_with_edit line of the /etc/netd.conf file. To work around this issue, make sure that all usernames on the users_with_edit line of the /etc/netd.conf file are configured local users for the system (real Linux users) |
3.7.0-4.3.0, 4.4.0-5.2.1 | 4.3.1, 5.3.0-5.15.0 |
| 2553887 |
When using TACACS+ configured with a DEFAULT user providing privilege level lower than 16, TACACS+ configured users with privilege level 16 access might not be able to run privilege level 16 NCLU commands, such as net add and net del and see an error similar to the following:
To work around this issue, remove the DEFAULT user from the TACACS+ server. |
3.7.7-3.7.16, 4.0.0-4.4.5 | |
| 2552739 |
Counters for IPROUTER rules do not increase when traffic is forwarded to the CPU because there is no IP neighbor. | 3.7.2-3.7.16 | |
| 2552528 |
Ingress SPAN/ERSPAN does not mirror packets when the next hop is EVPN encapsulated. | 3.7.7-4.2.1 | 4.3.0-4.4.5 |
| 2551675 |
When you restart clagd, the edge port setting on the peer link changes. |
3.7.2-4.2.0 | 4.2.1-4.4.5 |
| 2551288 |
When you remove BFD configuration by editing the /etc/frr/frr.conf file and restarting FRR, you see a traceback.To work around this issue, either use NCLU or vtysh commands to remove the BFD configuration, or restart FRR with the new /etc/frr/frr.conf file. |
3.7.7-3.7.16 | 4.0.0-4.4.5 |
| 2550478 |
VXLAN interface as in-interface or out-interface in an ACL is not supported in Spectrum-based switches. | 3.7.7-4.2.0 | 4.2.1-4.4.5, 4.3.0-4.4.5 |
| 2550323 |
After a neighbor is removed, the redistributed neighbor entry is withdrawn from the BGP table, but the prefix might still be selected as the bestpath when the host’s originated prefix is not advertised. To work around this issue, recreate the neighbor entry and flap the interface to the host. Or, if the host is already down, manually create a neighbor entry with an invalid MAC address, which forces redistribute neighbor to re-withdraw the entry. |
3.7.3-3.7.16 | 4.0.0-4.4.5 |
| 2548475 |
After you add a new VNI and a layer 3 SVI to a set of leafs, certain leafs might not be able to communicate on the layer 3 VNI. To work around this issue, reboot the leaf switch or restart switchd. |
3.7.6-3.7.16 | 4.0.0-4.4.5 |
| 2548382 |
The QuantaMesh BMS T3048-LY8 switch shows a low fan RPM in syslog. | 3.7.5-3.7.12, 4.0.0-4.1.1 | 3.7.13-3.7.16, 4.2.0-4.4.5 |
| 2548243 |
On switches with the Trident2+ ASIC, adding SPAN rules disables PBR rules. | 3.7.3-3.7.16, 4.0.0-4.4.5 | |
| 2547769 |
syslog might report a high load average with the CPU running a later microcode revision. |
3.7.4-3.7.12 | 3.7.13-3.7.16 |
| 2547012 |
On the Mellanox Spectrum switch, switchd can sometimes fail when PBR rules are installed or removed from hardware if the rule is setting a next hop learned via a routing protocol. |
3.7.7-3.7.11, 4.0.0-4.0.1 | 3.7.12-3.7.16, 4.1.0-4.4.5 |
| 2546998 |
When you configure Cumulus Linux with a /32 address on a switch port with a configured peer address (for example, to connect to a device using IP unnumbered), the switch sends GARPs for the peer address. | 3.7.5-3.7.11 | 3.7.12-3.7.16, 4.1.0-4.4.5 |
| 2546868 |
Broadcom Field Alert - SID - MMU 2B Errors A few of the MMU memories on Broadcom switches are grouped together with single parity control. During SER correction when a parity error occurs on one of those groups, other memory in that group might also report a SER error. This occurs when the memory is accessed either by a packet hit or through a schan operation. This issue can cause SER errors in other memory and cause traffic mis-forwarding or a packet drop. |
3.7.0-3.7.11, 4.0.0-4.0.1 | 3.7.12-3.7.16, 4.1.0-4.4.5 |
| 2546702 |
The FRR cl-support module times out on switches on the ARM platform even when the switch is not under heavy load. To work around this issue, run the cl-support -M command to disable timeouts. |
3.7.0-3.7.11, 4.0.0-4.0.1 | 3.7.12-3.7.16, 4.1.0-4.4.5 |
| 2546385 |
SNMP ifLastChange reports link transitions when there are none. | 3.7.6-3.7.16 | |
| 2545693 |
On rare occasions, after rebooting the MLAG secondary switch, one MLAG device might see the peer as down, which can cause traffic disruption to connected hosts. | 3.7.7-3.7.10 | 3.7.11-3.7.16, 4.1.0-4.4.5 |
| 2545599 |
IPv6 table rules might affect forwarding. For example, if you create the following rule in the /etc/cumulus/acl/policy.d/03-sshd.rules file, the rule counter increments but IPv4 SSH traffic might be dropped.
|
3.7.2-3.7.11, 4.0.0-4.0.1 | 3.7.12-3.7.16, 4.1.0-4.4.5 |
| 2545405 |
The ospfd daemon might crash with the following kernel trace:
|
3.7.6-3.7.10 | 3.7.11-3.7.16 |
| 2545235 |
On the Edgecore AS6812 switch, you might see rare I2C errors. | 3.7.2-3.7.10, 4.0.0-4.0.1 | 3.7.11-3.7.16, 4.1.0-4.4.5 |
| 2545132 |
On the Mellanox switch, ACL lookups are performed for VLAN matches when no rules with UNTAGGED match are present. |
3.7.2-3.7.10, 4.0.0-4.0.1 | 3.7.11-3.7.16, 4.1.0-4.4.5 |
| 2544846 |
You might experience a bgpd memory usage increase and significant update exchanges due to host moves between VTEPs. |
3.7.7-3.7.10, 4.0.0-4.0.1 | 3.7.11-3.7.16, 4.1.0-4.4.5 |
| 2544723 |
Setting ProtoDown on ports populated with SFP modules providing RJ-45 1000BASE-T interfaces does not cause the carrier to be dropped. The kernel shows carrier down; however, the remote device still shows a link. | 3.7.6-3.7.10, 4.0.0-4.4.5 | 3.7.11-3.7.16 |
| 2544609 |
BGP is configured with soft reconfiguration-in for its peers, which is not working correctly and causes routes to have an unexpected label. As a result, transit traffic is not forwarded by the switch. | 3.7.7-3.7.16 | 4.0.0-4.4.5 |
| 2544385 |
The QCT QuantaMesh BMS T7032-IX7 switch may report “failed to request GPIO pin” errors during the boot up. | 3.7.5-3.7.10 | 3.7.11-3.7.16 |
| 2544311 |
Applying a policy-based routing (PBR) rule for all traffic from a host might disrupt ARP refresh for that connected host. | 3.7.5-3.7.16, 4.0.0-4.4.5 | |
| 2544212 |
Cumulus Linux poed generates excessive debug log entries. These will be reduced in a future release. | 3.7.3-3.7.10, 4.0.0-4.0.1 | 3.7.11-3.7.16, 4.1.0-4.4.5 |
| 2544155 |
NCLU requires you to specify an interface with multiple address-virtual statements in ascending MAC address order. |
3.7.5-3.7.16, 4.0.0-4.4.5 | |
| 2543875 |
On the Mellanox Spectrum switch, a route withdrawal might cause the associated next hop neighbor entry to be deleted in hardware but remain in the kernel. This can cause traffic going through the directly connected route to the removed neighbor entry to be forwarded to the CPU. | 3.7.6-3.7.16 | 4.0.0-4.4.5 |
| 2543840 |
On the Mellanox SN2700 switch, you cannot enable resilient hashing (RASH) and set the bucket size to 64 in the traffic.conf file. |
3.7.6-3.7.16 | |
| 2543816 |
On the Dell S5248F-ON switch, smond might generate syslog messages indicating that the fan input RPM is lower than the normal low speed of 2500 RPM. Speeds as low as 1700 RPM are acceptable in normal thermal environments; therefore, you can ignore these messages. |
3.7.6-3.7.11, 4.0.0-4.4.5 | 3.7.12-3.7.16 |
| 2543781 |
NCLU does not allow you to configure OSPF NSSAs. For example:
To work around this issue, use FRR instead. For example:
|
3.7.7-3.7.10, 4.0.0-4.4.5 | 3.7.11-3.7.16 |
| 2543727 |
ACL rules, such as the following, fail to install if you use swp+ (interfaces mentioned as wildcards).
You can now install such rules with swp+. |
3.7.3-3.7.16 | 4.0.0-4.4.5 |
| 2543724 |
If a hostname contains utf-8 characters, the NCLU net show lldp command outputs the following error:
|
3.7.7-3.7.10, 4.0.0-4.4.5 | 3.7.11-3.7.16 |
| 2543667 |
On the EdgeCore AS4610 switch, the ping command fails unless you run the command with sudo. To work around this issue, run the following commands:
Run the following command to verify the workaround:
You should see the following output:
|
3.7.6-3.7.10, 4.1.0-4.1.1 | 3.7.11-3.7.16, 4.2.0-4.4.5 |
| 2543648 |
You cannot specify a source and destination MAC address in an ERSPAN ebtables rule. For example, the following rule does not work:
|
3.7.6-3.7.12, 4.0.0-4.1.1 | 3.7.13-3.7.16, 4.2.0-4.4.5 |
| 2543647 |
ERSPAN in ebtables does not work for VNIs. For example, the following rule does not work:
|
3.7.6-4.2.1 | 4.3.0-4.4.5 |
| 2543646 |
In an ebtables rule, ERSPAN (upper case) does not work. You need to specify erspan (lower case). | 3.7.6-3.7.16, 4.0.0-4.4.5 | |
| 2543627 |
Tomahawk 40G DACs cannot disable auto-negotiation. | 3.7.7-3.7.16 | 4.0.0-4.4.5 |
| 2543546 |
{watchfrr calls sudo /usr/sbin/service frr restart bgpd but restarts all FRR daemons which can cause a large outage. This occurs because watchfrr uses an old style service command, which causes all daemons to restart when a daemon fails. |
3.7.7-3.7.8 | 3.7.9-3.7.16 |
| 2543473 |
Configuring an inbound route map to manually change the next hop IP address received from an eBGP peer locally causes the next hop to not be updated when advertising this route out to other eBGP peers. To work around this issue, set a “dummy” route map outbound to the eBGP peer or configure the route map to manually set the next hop outbound from the originating eBGP peer. | 3.7.6-3.7.10 | 3.7.11-3.7.16 |
| 2543472 |
On switches with the Spectrum ASIC, the underlay hashes VXLAN packets for a given overlay flow randomly. To work around this issue, configure the ECMP hash seed to the same value on the EVPN egress leaf switches. |
3.7.7-4.0.1 | 4.1.0-4.4.5 |
| 2543389 |
Dynamic route-leaking works as expected until FRR is restarted or the switch is rebooted. After the restart or reboot, the import RT under the VRF where routes are being imported is incorrect. | 3.7.7-3.7.8 | 3.7.9-3.7.16 |
| 2543325 |
Lenovo switches do not send or receive LLDP on eth0 interfaces. | 3.7.7-3.7.16 | 4.0.0-4.4.5 |
| 2543211 |
In some cases, the switchd service might warn of excessive MAC moves from one switch port to itself (for example, from swp18 to swp18). |
3.7.0-3.7.16, 4.0.0-4.4.5 | |
| 2543164 |
The MTU of an SVI cannot be higher than the MTU on the bridge. Changing the MTU on the SVI with NCLU does not update the bridge MTU. The net commit command succeeds even though the MTU is not changed as expected.To work around this issue, change the MTU on all SVIs and the bridge manually in the /etc/network/interfaces file, then apply the change with the ifreload -a command. |
3.7.7-3.7.16, 4.0.0-4.4.5 | |
| 2543113 |
NCLU restarts FRR when attempting to remove a BGP VRF stanza. This happens regardless of whether the VRF is valid/configured elsewhere on the switch or the removal is successful. To work around this issue, remove the stanza using vtysh. |
3.7.3-3.7.16 | 4.0.0-4.4.5 |
| 2543096 |
When an SVI with a virtual MAC is configured with a layer 2 VNI in an EVPN environment, if you replace the /etc/network/interfaces file with a different file that does not have the SVI and layer 2 VNI configuration, the original virtual MAC is not populated through the EVPN route until FRR is restarted. |
3.7.6-3.7.16, 4.0.0-4.4.5 | |
| 2543061 |
When you run the hostnamectl status command or start the systemd-hostnamed process, you see constant unregister_netdevice kernel messages in syslog and on the console. This causes syslog to become filled with these messages and makes troubleshooting difficult. |
3.7.7 | 3.7.8-3.7.16 |
| 2543058 |
The IP neighbor entry for a link-local next hop is not installed by FRR, which results in a forwarding failure for routes via that next hop. This is a rare problem that occurs with IPv4 route exchange over IPv6 GUA peering with no IPv4 addresses on the interfaces. To work around this issue, flap the peering to the peer router (which might be a route reflector) to recover. To avoid this issue, configure IPv6 router advertisements on the connecting interfaces. |
3.7.7-3.7.16 | 4.0.0-4.4.5 |
| 2543052 |
Received EVPN type-5 and type-2 MACIP routes are not installed in the kernel (and hardware) routing tables for the associated VRF, which causes traffic to be blackholed. The failure to install the default route causes complete reachability failure for the particular tenant on the affected racks. The routes that are not installed are seen as “inactive” in the routing subsystem (FRR) VRF routing table. This problem is rare and can occur only in EVPN configurations that have user-configured route targets (RTs) for tenant VRFs, and only following a restart of FRR. To work around this issue, either restart the FRR service on the affected switch with the sudo systemctl restart frr.service command or bounce the layer 3 SVI for the affected VRF; for example:
You can run the net show vrf vni command to print a mapping of VRF : L3-VNI : L3-SVI. |
3.7.5-3.7.16 | 4.0.0-4.4.5 |
| 2543044 |
Under certain conditions, EVPN next hops might not be removed when the contributing peer goes down or might not be populated when the BGP session to the contributing peer comes up. You can prevent EVPN next hops from not being removed when the contributing peer goes down by specifying static MAC addresses on all layer 3 VNIs. There is no workaround for preventing EVPN next hops from not being populated when the BGP session to the contributing peer comes up. |
3.7.2-3.7.16 | 4.0.0-4.4.5 |
| 2543004 |
Cumulus Linux installer images have a shell script that validates checksum integrity. When you run onie-install, this check is run but the installer is still staged even if the checksum validation fails. To work around this issue, perform your own checksum validation before staging a new image with onie-install. |
3.7.7-3.7.8 | 3.7.9-3.7.16 |
| 2542985 |
On a Tomahawk switch, the 5m 40G DACs (40G CR4) do not come up when both sides have auto-negotiation enabled. | 3.7.7-3.7.8 | 3.7.9-3.7.16 |
| 2542979 |
On the Dell-N3048EP-ON switch, when you run the sudo -E apt upgrade command, the upgrade does not work. |
3.7.7-4.1.1 | 4.2.0-4.4.5 |
| 2542958 |
When transitioning from a down state to an up state due to peerlink failure and recovery, MLAG does not start the initDelay timer before trying to bring everything back up. | 3.7.7-3.7.16 | 4.0.0-4.4.5 |
| 2542945 |
On the Broadcom Maverick switch with a QinQ configuration, the packets coming into the CPU might be tagged incorrectly; for example, 802.1ad + 802.1q tags are expected in the packets but the packets have 802.1q + 802.1q tags. To work around this issue, configure the bridge with bridge-vlan-protocol 802.1ad:
|
3.7.6-3.7.16, 4.0.0-4.4.5 | |
| 2542913 |
IF-MIB::ifHCInOctets reports significantly lower values than reported by interface counters seen elsewhere. | 3.7.6-3.7.16 | 4.0.0-4.4.5 |
| 2542871 |
After you issue the NCLU net del bgp vrf command and commit the change, Cumulus Linux does not remove the configuration from the /etc/frr/frr.conf file or the net show config commands. |
3.7.3-3.7.10, 4.0.0-4.0.1 | 3.7.11-3.7.16, 4.1.0-4.4.5 |
| 2542853 |
For interfaces configured with RS FEC, when switchd is restarted, the link goes down but does not automatically come back up. This occurs because the FEC status is not replayed correctly into the kernel. To work around this issue, run the ifreload -a command to bring up the interface after switchd is restarted. |
3.7.6-3.7.8 | 3.7.9-3.7.16 |
| 2542837 |
On Mellanox switches, policer iptables are not working as expected. For example, when using a policer with mode KB/MB/GB to rate-limit interfaces, the syntax is accepted but the data plane transfer speed is not affected by the rule. | 3.7.6-3.7.8, 4.0.0-4.4.5 | 3.7.9-3.7.16 |
| 2542835 |
snmpd fails because NCLU does not remove agentaddress @vrf lines when running the net add snmp-server listening-address all command. |
3.7.4-3.7.16 | 4.0.0-4.4.5 |
| 2542823 |
On the Broadcom Trident 3 switch, VXLAN encapsulated packets are dropped on the ingress port (tagged layer 2 port) during transit forwarding (the local switch does not terminate the VXLAN tunnel). An example of where this two-layer VXLAN inside VXLAN encapsulation might occur: - VXLAN tunnel (#1) between two servers (different racks) to provide layer 2 extension for containers or VM hosts. - VXLAN tunnel (#2) between the TOR switch in rack 1 to the TOR switch located in the remote rack. To work around this issue, either: - Configure the edge port (facing the servers) to be an access port (instead of a trunk/tagged port) - Change the destination port from 4789 to something else (VXLAN tunnel terminated by the servers) |
3.7.5-3.7.11, 4.0.0-4.0.1 | 3.7.12-3.7.16, 4.1.0-4.4.5 |
| 2542819 |
On the Trident3 platform, you can only add 50 percent of the total ECMP next hops. A log message indicates that the table is full. | 3.7.7-3.7.8 | 3.7.9-3.7.16, 4.0.0-4.4.5 |
| 2542774 |
When moving an IP address from the address line to inet dhcp, then issuing the ifreload -a command, the old address is not removed from the interface. NCLU still reports the old address only and reports it as a DHCP address. |
3.7.6-3.7.8 | 3.7.9-3.7.16 |
| 2542767 |
If the BMC operating system fails to respond to IPMI, you see a traceback in bmcd and all the sensors might report ABSENT devices in smonctl. To work around this issue, power cycle the switch. |
3.7.6-4.0.1 | 4.1.0-4.4.5 |
| 2542765 |
When you configure the switch to send an EAP request with the net add dot1x send-eap-request-id command, the switch ignores re-authentication attempts and does not send back an EAPol. |
3.7.6-3.7.10 | 3.7.11-3.7.16 |
| 2542726 |
After configuring switchd hal.bcm.per_vlan_router_mac_lookup to TRUE on a Broadcom switch, layer 2 traffic works over VXLAN but the host is not able to ping the locally connected gateway and loses routing ability to other IPs and subnets. |
3.7.5-3.7.8 | 3.7.9-3.7.16 |
| 2542711 |
BGP update packets are sometimes missing the mandatory nexthop attribute, which causes connections to reset. For example, this issue is seen when using VRF route leaking with a mix of BGP unnumbered and BGP numbered peers. |
3.7.6-3.7.8 | 3.7.9-3.7.16 |
| 2542509 |
In EVPN symmetric or centralized configurations with BGP peering over a peer link, VXLAN routed packets transiting an MLAG peer are dropped until the clagd init-delay timer expires during the bring-up sequence following a reboot.The problem is caused by a race condition when programming the anycast IP address (used to terminate VXLAN tunnels), where the hardware is programmed before the software by clagd.To work around this issue, configure the BGP path across the peer link to be less preferred. The example below uses AS path prepending and the MLAG switches are iBGP neighbors. However, other BGP configurations achieve the same result. In the /etc/frr/frr.conf file, make a new AS path access list and route map to apply BGP pre-pending of the local ASN one or more times. For example:
|
3.7.6-3.7.10, 4.0.0-4.0.1 | 3.7.11-3.7.16, 4.1.0-4.4.5 |
| 2542480 |
When BGP remove-private-AS replace-AS is configured under the BGP IPv4 or IPv6 address family between a pair of switches configured as BGP peers, a BGP route update might cause the BGP session to flap. To work around this issue, do not configure remove-private-AS replace-AS in the BGP IPv4 or IPv6 address family. |
3.7.6-3.7.8 | 3.7.9-3.7.16 |
| 2542384 |
When you define a trap destination using @mgmt, snmpd indicates that the network is unreachable even though the IP address is reachable in the management VRF. To work around this issue, remove @mgmt vrf references in the /etc/snmp/snmpd.conf file, stop snmpd, then start snmpd manually in the management VRF with the systemctl start snmpd@mgmt command. |
3.7.6-3.7.16 | 4.0.0-4.4.5 |
| 2542365 |
The snmpd service frequently crashes due to double free or corruption. |
3.7.6-3.7.8 | 3.7.9-3.7.16 |
| 2542341 |
The IP neighbor entry for a link-local next hop (169.254.x.x) is not installed by FRR, which results in a forwarding failure for routes via that next hop. This is a rare problem that occurs with IPv4 route exchange over IPv6 GUA peering with no IPv4 addresses on the interfaces. To work around this issue, flap the peering to the peer router (which can be a route reflector) to recover. To avoid this issue, configure IPv6 router advertisements on the connecting interfaces. |
3.7.7-3.7.8 | 3.7.9-3.7.16 |
| 2542336 |
On the Mellanox SN2410 switch, switchd does not start. |
3.7.2-3.7.8 | 3.7.9-3.7.16 |
| 2542310 |
hsflow disregards the setting for agent.cidr in the /etc/hsflowd.conf file and selects an IPv6 agent address. The source IP address of the hsflowd packet is IPv4, but the agent address in the hsflow payload shows IPv6. |
3.7.6-3.7.16 | |
| 2542305 |
If an SVI exists in the configuration before you assign it an IP address, when you do assign the IP address with the NCLU command, the vlan-id and the raw-device bridge stanzas are not added automatically. |
3.7.6-3.7.16, 4.0.0-4.4.5 | |
| 2542301 |
When first creating a bond and enslaving an interface, NCLU hides some of the bridge command suggestions, although they are still accepted. |
3.7.3-3.7.16, 4.0.0-4.4.5 | |
| 2542297 |
When you run the NCLU net del all command, the exec-timeout setting changes in the /etc/frr.frr.conf file. |
3.7.6-3.7.8 | 3.7.9-3.7.16 |
| 2542248 |
When you generate a cl-support file, clagd.service prints log messages similar to the following:
|
3.7.6-3.7.16 | 4.0.0-4.4.5 |
| 2542193 |
When you configure the link-down yes attribute to a physical SVI, the VRR (-v0) interface is not brought down, and the locally-connected subnet can still be redistributed into routing protocols and advertised to neighbors despite the physical SVI being administratively down. To work around this issue, manually bring down the VRR (-v0) interface with the ip link set dev command. For example:
|
3.7.6-3.7.8 | 3.7.9-3.7.16 |
| 2542058 |
The ifquery command should return a non-zero value if there is a syntax error. However, it currently returns zero. This issue affects automation scripts that validate a file before copying it into place. |
3.7.6-3.7.8 | 3.7.9-3.7.16 |
| 2542031 |
If you configure a sys-mac with a single digit, ifreload -a does not indicate that the MAC address is invalid for the MLAG sys-mac and the clagd process fails silently. |
3.7.6-3.7.8 | 3.7.9-3.7.16 |
| 2541924 |
If the address-virtual MAC address is missing a leading zero in the last octet, the interface bounces. |
3.7.6-3.7.8 | 3.7.9-3.7.16 |
| 2541604 |
The snmpd service exits with a message similar to the following:
This problem might occur during or after network convergence events. For example, when bgpd needs to process a high number of updates and the CPU cannot keep up, bgpd is disconnected and agentx generates a core dump in snmpd due to a memory allocation problem. To work around this issue, disable agentx by commenting out the following lines in the /etc/snmp/snmpd.conf file. Then, restart the snmpd service with the systemctl restart snmpd command.
If you still want to poll the BGP4-MIB information, re-enable the bgp pass persist script by adding the following line in the /etc/snmp/snmpd.conf file:
|
3.7.2-3.7.8 | 3.7.9-3.7.16 |
| 2541212 |
The maximum-prefix configuration under the IPv4 address family has an optional restart value, which you can configure. This configuration is ignored and, instead of restarting the sessions every x minutes, the peer constantly changes between established and idle due to the prefix count being exceeded. |
3.7.5-3.7.16, 4.0.0-4.4.5 | |
| 2541165 |
On the Dell N3048EP-ON switch, UPOE is supported only on ports 1 thru 12. (UPOE uses all four pairs of standard Ethernet cabling whereas PoE delivers power over two twisted pairs.) When you plug a UPOE device in a port higher than port 12, poectl reports that four_pair_mode_enabled is true. However, this configuration is not supported on the port so poectl should report that four_pair_mode_enabled is false. |
3.7.6-3.7.16 | |
| 2541029 |
On switches with the Trident2 ASIC, 802.1Q-encapsulated control plane traffic received on an interface with 802.1AD configured subinterfaces might be dropped. This issue only affects QinQ configurations. |
3.7.5-3.7.16, 4.0.0-4.4.5 | |
| 2541003 |
NCLU is unable to delete a BGP neighbor configuration if there is a VRF VNI mapping in the /etc/frr/frr.conf file. For example, the following NCLU command produces an error:
|
3.7.7-3.7.8 | 3.7.9-3.7.16, 4.0.0-4.4.5 |
| 2540950 |
On the QuantaMesh T4048-IX8 or EdgeCore AS7326-56X switch, when using a 1000BASE-T SFP module, the module LEDs do not light to reflect link status. |
3.7.3-4.1.1 | 4.2.0-4.4.5 |
| 2540885 |
The Dell N3048EP-ON switch does not support 1G Base-T modules in the SFP ports. | 3.7.7-3.7.16 | |
| 2540863 |
On the EdgeCore AS5812-54X switch, the PSU2 Fan1 fluctuates between OK and LOW. When the fan speed is reported as LOW, the RPM is shown as a negative number. |
3.7.3-3.7.16 | |
| 2540753 |
If the interface alias contains a single or double quotation mark, or an apostrophe, the net show configuration commands fail with the following error:
|
3.7.5-3.7.16, 4.0.0-4.4.5 | |
| 2540684 |
On a Dell S5248F (Trident3) switch, packets from switch ports are forwarded to the CPU and are sometimes corrupted. The corruption might result in BGP peerings being down, which can lead to all VXLAN traffic to and from a node to be lost, causing an outage to dually connected hosts in a rack. To work around this issue, restart switchd. |
3.7.3-3.7.8 | 3.7.9-3.7.16, 4.0.0-4.4.5 |
| 2540600 |
If the clagd-vxlan-anycast-ip is removed from the /etc/network/interfaces file (either with the NCLU command or by editing the file manually), MLAG still believes it is present until clagd restarts. |
3.7.3-3.7.8 | 3.7.9-3.7.16, 4.0.0-4.4.5 |
| 2540444 |
SNMP incorrectly requires engine ID specification. |
3.7.4-3.7.16, 4.0.0-4.4.5 | |
| 2540359 |
bgpd creates a core dump at zclient_send_interface_radv_req. This is an issue with how FRRouting checks next hops and has been pushed upstream to FRRouting. |
3.7.6-3.7.8 | 3.7.9-3.7.16 |
| 2540352 |
When you use NCLU to configure a route map, the parser allows for glob matching of interfaces for a match interface condition when there can only be a single interface matched. The proper syntax is to use multiple route map clauses, each matching a single interface, instead of a single clause matching multiple interfaces. For example, this command is incorrect:
These commands are correct:
|
3.7.2-3.7.16, 4.0.0-4.4.5 | |
| 2540340 |
NCLU allows for the configuration of addresses on VRF interfaces, but tab completion for the net add vrf command just displays
Tab completion for the net add vrf command works correctly. |
3.7.4-3.7.16, 4.0.0-4.4.5 | |
| 2540274 |
On the Maverick switch, CPU forwarded packets might be dropped when there is no route to a leaked host route. | 3.7.5-3.7.16, 4.0.0-4.4.5 | |
| 2540204 |
When links come up after FRR is started, VRF connected routes do not get redistributed. | 3.7.4-3.7.16, 4.0.0-4.4.5 | |
| 2540192 |
The net del bridge bridge mcsnoop yes command does not return the value to the default of disabled. To work around this issue, use the net add bridge bridge mcsnoop no command to delete the mcsnoop attribute and return to the default value. |
3.7.4-3.7.16, 4.0.0-4.4.5 | |
| 2540155 |
On the Broadcom switch, when moving configuration from bridged to routed (or toggling from routed to bridged to routed), some traffic is not seen by the kernel. This can cause BGP to not establish on a transit node. |
3.7.3-3.7.16, 4.0.0-4.4.5 | |
| 2540042 |
When you try to configure the VRRP priority and advertisement-interval with NCLU on a traditional mode bridge, the net commit command fails. To work around this issue, use the vtysh command (inside FRR) to change the VRRP priority or advertisement-interval on traditional bridges. For example:
|
3.7.4-3.7.16, 4.0.0-4.4.5 | |
| 2540041 |
On SVIs in a VLAN-aware bridge, you cannot change the VRRP priority with NCLU. To work around this issue, run the vtysh command inside FRR to change the default priority. For example:
|
3.7.4-3.7.16, 4.0.0-4.4.5 | |
| 2540040 |
Cumulus Linux uses VRRPv3 as the default version, and enables both preempt and accept mode by default. You cannot change these default values with NCLU. To work around this issue, run the vtysh commands (inside FRR) to change the default values. For example:
|
3.7.4-3.7.16, 4.0.0-4.4.5 | |
| 2540031 |
NCLU does not honor auto all in the /etc/network/interfaces file and removes the existing configuration if no individual auto lines exist. |
3.7.3-3.7.16, 4.0.0-4.4.5 | |
| 2539994 |
When you try to remove a BGP peer group configuration with NCLU, the command fails but no warning message is shown. For example:
|
3.7.2-3.7.16, 4.0.0-4.4.5 | |
| 2539962 |
When an LDAP user that does not have NCLU privileges (either in the netshow or netedit group, or in the /etc/netd.conf file) runs an NCLU command, a traceback occurs instead of a permissions error. |
3.7.0-3.7.16, 4.0.0-4.4.5 | |
| 2539670 |
On the Edgecore 4610-54P switch, automatic medium-dependent interface crossover (auto-MDIX) stops working on a 100M full duplex interface and does not detect the required cable connection type. |
3.7.2-3.7.16, 4.0.0-4.4.5 | |
| 2539124 |
The net add interface command adds no ptm-enable for that interface in the frr.conf file. Running the net add or the net del command does not remove no ptm-enable from the frr.conf file. You have to remove it manually using vtysh. |
3.7.2-3.7.16, 4.0.0-4.4.5 | |
| 2539081 |
When you delete post-up and pre-down IP peer entries from the etc/network/interfaces file, then run the ifreload command, the IP addresses are not removed and the route remains in the route table. To work around this issue, either delete the IP addresses without the /32 mask component or flush the IP addresses for the interface with the ip addr flush dev command. |
3.7.0-3.7.16 | 4.0.0-4.4.5 |
| 2538875 |
IPv6 multicast traffic destined to an unregistered multicast group is flooded to all ports in a bridge despite the bridge.optimized_mcast_flood = TRUE setting in the /etc/cumulus/swichd.conf file. |
3.7.2-3.7.16 | |
| 2538790 |
NCLU automatically adds the VLAN ID (for the layer 3 VNI/SVI) to the bridge when you run net add vxlan . This configuration breaks network connectivity in an EVPN symmetric routing configuration using MLAG. To restore connectivity, remove the VLAN ID from the bridge. |
3.7.2-3.7.16, 4.0.0-4.4.5 | |
| 2538741 |
The NCLU command net show bridge spanning-tree does not show the MLAG peer link as part of the STP forwarding instance.To work around this issue, use the mstpctl command to confirm the STP status of the port. |
3.7.2-3.7.8 | 3.7.9-3.7.16 |
| 2538590 |
When you configure a control plane ACL to define permit and deny rules destined to the local switch, NCLU programs the control plane ACL rules into the FORWARD chain. |
3.7.2-3.7.16, 4.0.0-4.4.5 | |
| 2538562 |
On an RMP/1G-T switch, when you remove link-speed 100 with the NCLU command or by editing the etc/network/interfaces file to revert the 100M interface to the default (1G auto), the interface fails to recover and does not come back up.After you remove the link-speed, ethtool shows the advertised link modes as not reported and Speed/Duplex as unknown.To work around this issue and bring the interface back up, either restart switchd or use ethtool to configure the speed, advertised, duplex or MDI-X settings. Note: The advertised link mode gets set incorrectly if you include 1000baseT/Half. The port will come up successfully at 1G. |
3.7.2-3.7.16, 4.0.0-4.4.5 | |
| 2538480 |
Modifying the /etc/netd.conf file to set show_linux_command = True does not take effect. |
3.7.2-3.7.8 | 3.7.9-3.7.16 |
| 2538302 |
portwd allows an error to change the module type based on the error. For example, a bad write to a module might cause the module type to flap, which causes the link itself to flap. |
3.7.0-3.7.16 | |
| 2538294 |
If you use NCLU to create an iBGP peering across the peer link, running the net add bgp l2vpn evpn neighbor peerlink.4094 activate command creates a new eBGP neighborship when one has already been configured for iBGP. This is unexpected; the existing iBGP configuration is valid. |
3.7.0-3.7.16, 4.0.0-4.4.5 | |
| 2538256 |
On the Broadcom switch, when a link-local multicast frame is received on an access port with a VNI in the bridge, two copies of the packet are sent across the VNI to remote VTEPs and the receiving hosts observe duplicate packets. |
3.7.2-4.0.1 | 4.1.0-4.4.5 |
| 2538022 |
When you remove an interface from a bridge and add it to a VRF in the same commit/ifreload, the IPv6 link-local address is not created automatically. To work around this issue, do the change in two separate commits. First, remove the interface from the bridge, which causes it to be a layer 2 interface. Then, enslave the interface to the VRF. |
3.7.2-3.7.8 | 3.7.9-3.7.16 |
| 2537819 |
When you enable FEC (RS or BaseR) on an interface, removing the configuration from that interface does not revert the FEC status to off/none. |
3.7.2-3.7.16 | 4.0.0-4.4.5 |
| 2537699 |
There is a limitation on the number of SVI interfaces you can specify as DHCP relay interfaces in the /etc/default/isc-dhcp-relay file. For example, 1500 SVI interfaces causes the dhcrelay service to exit without a core file and logs similar to the following are generated for the interfaces:
Eventually the dhcrelay service stops. |
3.7.1-3.7.16, 4.0.0-4.4.5 | |
| 2537544 |
When you run the mstpctl command, you might see the bridge-port state as blocking when it is actually disabled. You might see the same incorrect bridge-port state when other programs or tools use the output of mstpctl; for example, SNMP output from the BRIDGE-MIB. |
3.7.1-3.7.16, 4.0.0-4.4.5 | |
| 2537536 |
When FRR restarts, snmp[err] dev/kmem: Permission denied error messages are recorded in the log file and SNMPd might crash periodically. |
3.7.5-3.7.16 | 4.0.0-4.4.5 |
| 2537378 |
NCLU SNMPv3 user configuration (add, delete, modify) does not complete. Changes are made to the /etc/snmp/snmpd.conf file but the SNMPv3 user cache file /var/lib/snmp/snmpd.conf fails to update correctly and the configuration does not reflect in operation. To work around this issue, stop snmpd, remove the cache file, then restart snmpd. |
3.7.1-3.7.16 | |
| 2537188 |
When an event in the network, such as a switchd or networking service restart, leads to an OVSDB server high availability transition, an ovs-vtepd core might occur. This core generation has no effect on the functionality of high availability when the active OVSDB server is back in the network. |
3.7.2-3.7.16 | |
| 2537153 |
In rare cases, certain IPv6 BGP peers fail to reestablish after switchd restarts. |
3.7.2-3.7.8 | 3.7.9-3.7.16 |
| 2537104 |
When you try to stop hsflowd on the Trident II+ switch with the systemctl stop hsflowd command, the process hangs until you stop it with SIGKILL. |
3.7.1-3.7.16 | 4.0.0-4.4.5 |
| 2537061 |
The Dell S5048F-ON switch (with reverse airflow, rear to front), shows the Temp-3 sensor as absent. |
3.7.1-4.0.1 | 4.1.0-4.4.5 |
| 2536650 |
Mellanox Spectrum and Helix4 switches occasionally send malformed packets and do not send any flow samples (only counters). While this issue is fixed for switches with the Spectrum ASIC, this is a [known limitation|https://docs.cumulusnetworks.com/cumulus-linux/Monitoring-and-Troubleshooting/Network-Troubleshooting/Monitoring-System-Statistics-and-Network-Traffic-with-sFlow/#caveats-and-errata] on this Helix4 platform. |
3.7.0-3.7.8 | 3.7.9-3.7.16, 4.0.0-4.4.5 |
| 2536639 |
On a Dell S4048 switch, when you set the eth0 speed to 100, either with NCLU or by editing the /etc/network/interfaces file, the igb driver crashes, which brings down eth0. To work around this issue: * If eth0 is configured in the management VRF, power cycle the switch; the eth0 configuration fails and reverts back to the default (auto-negotiation/1000). * If eth0 is configured in the default VRF and you power cycle after the crash, igb continues to crash on boot up (before getting to login prompt); power-cycle the switch, select the Advanced option in GRUB to boot to recovery mode, then modify the /etc/network/interfaces file. |
3.7.0-3.7.16 | 4.0.0-4.4.5 |
| 2536608 |
Single tagged ARP requests received on a QinQ-over-VXLAN access port are dropped if ARP suppression is enabled on an unrelated VNI. |
3.7.0-3.7.16 | |
| 2536559 |
When deleting an interface using NCLU, if the /etc/network/interfaces alias is different than the /etc/frr/frr.conf description, the net commit command returns the following error:
Despite this error, the change is made and the description is removed from the frr.conf file. |
3.7.3-3.7.10 | 3.7.11-3.7.16 |
| 2536384 |
The BFD packet redirection logic used by OVSDB server high availability mode redirects BUM packets across the peer link. The iptables rule for redirection does differentiate between BFD and non-BFD VXLAN inner packets because the service node sends all frames with its own IP address as the tunnel source IP address. The VXLAN encapsulated BUM packets do not get forwarded to the CPU and do not go through the iptable redirection rule; only VXLAN encapsulated BFD packets get forwarded to the CPU due to the inner MAC DA lookup in hardware. |
3.7.0-3.7.16, 4.0.0-4.4.5 | |
| 2536230 |
On the Broadcom switch with the Trident3 ASIC, the ECN-CE bit is set by default on transit traffic. This might result in hosts adjusting traffic behavior if they are configured for the ECN feature. In Cumulus Linux 3.7.11, the default behavior changed; the ECN-CE bit is no longer set by default on transit traffic. |
3.7.3-3.7.10, 4.0.0-4.0.1 | 3.7.11-3.7.16, 4.1.0-4.4.5 |
| 2536179 |
On switches with the Trident 2+ ASIC, counters associated with VLANs and VRFs are not working. | 3.7.0-3.7.16, 4.0.0-4.4.5 | |
| 2535986 |
At a high CPU transmit traffic rate (for example, if there is unexpected CPU generated flooding or replication in software), when the ASIC packet driver cannot keep up with the transmit rate because there are no free DMA buffers, it can back pressure by suspending the switch port transmit queues. This can fill up the application socket buffers resulting in No buffer space available error messages on protocol sockets.When the driver recovers, it automatically resumes the transmit queues. In most cases these error messages are transient. In rare cases, the hardware queues might get stuck, which you can recover with a switchd restart. |
3.7.0-3.7.16, 4.0.0-4.4.5 | |
| 2535965 |
On the Trident3 switch, static PIM with IIF based on a layer 2 bridge does not work reliably. PIM Join via signaling is required for IPMC to work properly. To work around this issue, use dynamic signaling (joins) to manage IP multicast traffic. |
3.7.0-3.7.16, 4.0.0-4.4.5 | |
| 2535209 |
The net show lldp command sometimes shows the port description in the Remote Port field. The net show interface command shows the correct value in the Remote Host field.To work around this issue, use net show interface command for LLDP output when connected to Cisco equipment. |
3.7.5-3.7.10, 4.0.0-4.4.5 | 3.7.11-3.7.16 |
| 2534450 |
The default BGP instance must be provisioned and always exist for proper operation of dynamic leaking of routes between VRFs. | 3.7.0-3.7.16 | 4.0.0-4.4.5 |
| 2528990 |
During a link flap test, you might occasionally see a message similar to: warning: swp6: netlink: cannot set link swp6 down: [Errno 98] Address already in use. |
3.7.6-3.7.10 | 3.7.11-3.7.16 |
Fixed Issues in 3.7.7
| Issue ID | Description | Affects |
|---|---|---|
| 2542338 |
In a typical CLOS network, each leaf is connected to all spine nodes; VXLAN packets follow leaf-spine links. However certain failure scenarios or maintenance activity might result in the MLAG primary switch being isolated from the spine layer (the only available network path is now across the peer link). As a result, the MLAG primary switch fails to transmit VXLAN encapsulated packets out on the peer link. It is also possible for the MLAG secondary switch to be isolated from the spine layer and then the problem is seen on the MLAG secondary switch. The issue occurs because the Broadcom Trident3 switch does not perform VLAN translation for VXLAN encapsulated packets where the tunnel is not terminated. To work around this issue, configure the BGP peering on a new VLAN interface (for example, vlan4093) instead of the peer link sub-interface (peerlink.4094). |
3.7.6 |
| 2542309 |
When all ports are split into 4X on the EdgeCore AS7726 switch, switchd fails to start up and a crash is seen in syslog. |
3.7.5-3.7.6 |
| 2541869 |
SNMP shows 0 for all swp interfaces in the ifSpeed field (bond interfaces, lo and eth0 are not affected and show a value). |
3.7.6 |
| 2541805 |
The clear bgp command does not support multiple address families. For example, the following command clears IPv6 unicast and ignores IPv4 unicast:
To clear IPv4 unicast, use the clear ip bgp command. For example, the following command clears IPv4 unicast and ignores IPv6 unicast:
|
|
| 2541791 |
In Cumulus Linux 3.7.6 and earlier, ifupdown2 does a string comparison to see if two addresses are the same. In Cumulus Linux 3.7.7, ifupdown2 does an integer comparison. For example, in Cumulus Linux 3.7.6 and earlier, hwaddress 00:00:5e:62:f8:02 and hwaddress 00:00:5e:62:f8:2 are not considered to be equal. In Cumulus Linux 3.7.7 and later, they are considered equal since 2 implies a leading zero. |
3.7.5-3.7.6 |
| 2541761 |
A TACACS privilege level 15 user mapped to tacacs15 cannot use net commands even though the user is part of the netedit and/or netshow user group. |
3.7.2-3.7.6 |
| 2541749 |
In a highly-scaled environment, while BGP is undergoing initial convergence, watchfrr times out and bgpd stops responding. |
3.7.5-3.7.6 |
| 2541685 |
If you have a configuration with more than 128 VRFs, BGP routes stop advertising. | 3.7.6 |
| 2541654 |
On the Dell N3048EP switch, the I2C bus might lock and when you log into the console, you see the following message. bcm-iproc-i2c 1803b000.i2c: bus is busy As a result, temperatures cannot be monitored. However, traffic is not affected (links do not go down). |
3.7.6 |
| 2541645 |
Received EVPN type-5 routes are not installed into the kernel VRF routing table even though the route appears to be correct. The failure to install the default route makes the rack unreachable from the external world. | 3.7.5-3.7.6 |
| 2541505 |
The vtep-ctl list-ports returns ports with the fully qualified domain name of the switch instead of the short hostname. |
3.7.6 |
| 2541494 |
Under certain circumstances (when you reboot or restart the switchd service), a race condition might occur which causes a synchronization issue resulting in hardware misprogramming of the VXLAN tunnel endpoint interface (VTEP). Packets destined out this tunnel are dropped in the egress direction. Packets arriving on this tunnel are dropped in the ingress direction. This is due to a race condition between ASIC and kernel programming that causes the kernel to incorrectly process the link state of a VXLAN interface. To work around this issue, you can bounce the layer 3 SVI for the affected VRF. For example:
Run the net show vrf vni command to show a mapping of the layer 3 VNI to layer 3 SVI for the VRF. Note: This workaround is not guaranteed because the race condition cannot be always be avoided. |
3.7.4-3.7.6 |
| 2541362 |
If you configure bridge-learning off on a host-facing link in a VXLAN/EVPN environment and are using static FDB entries instead, when you turn bridge-learning on and delete those static entries, they are re-learned as expected in the bridge FDB table, however they are not installed into FRR and a log message is recorded in /var/log/frr/frr.log. |
3.7.5 |
| 2541294 |
In an EVPN configuration, the old MAC/IP route is present in the routing table after an IP mobility event. | 3.7.5-3.7.6 |
| 2541213 |
On Trident2 switches, egress double-tagged frames incorrectly use 802.1Q outer ethertype instead of 802.1AD. | 3.7.5-3.7.6 |
| 2541134 |
On the Broadcom switch, TPID programming is not reset when there is a configuration change. As a result, you see unexpected packet drops. | |
| 2541107 |
The poectl -j command output does not show the correct port numbering in JSON; it is off by one. |
3.7.6 |
| 2541095 |
The RADIUS AAA client does the source IP address bind first, then the setsockopt VRF, which causes a failure due to a kernel check for an address mismatch with the VRF. |
3.7.4-3.7.6 |
| 2541090 |
The dhcrelay service crashes when the DHCP relay packet comes back from the server. To work around this issue, remove the –nl flag from the dhcrelay service. |
3.7.3-3.7.6 |
| 2540980 |
After upgrading the BIOS to 3.21.0.0-6, when you run the reboot, shutdown or init commands with certain options, the switch powers off. To determine the BIOS version of the switch, run:
|
3.7.5-3.7.6 |
| 2540895 |
On the EdgeCore AS4610-54P switch, at any moment and without warning, your PoE devices might all go down as PoEd crashes and an error message might be logged. There is no functional impact after a restart. | 3.7.6 |
| 2540843 |
On the Dell S3048 switch, ports with FEC disabled show as BaseR on boot up. | 3.7.3-3.7.6 |
| 2540830 |
On the Dell S5248F switch, packets forwarded to the CPU are corrupted. | 3.7.3-3.7.6 |
| 2540823 |
On the EdgeCore 7326-54X switch, switchd does not start on initial install because the decode-syseeprom command fails. However in ONIE, onie-syseeprom has no issues. |
3.7.5-3.7.6 |
| 2540737 |
When you commit a configuration change to a VXLAN layer 2 VNI in an MLAG configuration, the peer link on the MLAG secondary switch goes into an STP blocking state. | 3.7.2-3.7.6 |
| 2540721 |
If you modify BFD timers in the /etc/frr/frr.conf file, then run the systemctl reload frr command, the neighbor connections flap. |
3.7.4-3.7.6 |
| 2540557 |
On Trident3 switches, transit packets larger than 1500 bytes(DF) routed between SVIs is unexpectedly forwarded to the CPU even when the MTU is greater than 9000. This severely limits throughput for routed jumbo frames as packets arriving at a high interval are dropped to the CPU. | 3.7.0-3.7.6 |
| 2540464 |
If you have dynamic route leaking configured between any two VRFs and the BGP instance for the default VRF is not defined, removing an import vrf statement crashes bgpd. This occurs even if neither of the leaking VRFs are the default VRF. |
3.7.4-3.7.6 |
| 2540268 |
An incorrect readout of the optical transceiver high temperature alarm threshold (read as 17 degrees centigrade), disables a 100G optical module on Mellanox Spectrum switches. | 3.7.2-3.7.6 |
| 2540017 |
The net commit command fails when you try to add a static voice VLAN or delete dot1x configuration for an interface when the port is already authorized. |
3.7.4-3.7.6 |
| 2539928 |
When you delete or add 802.1X configuration on a port in a traditional mode bridge, all the ports are removed from the bridge. | 3.7.4-3.7.6 |
| 2539686 |
The Cumulus Linux switch sometimes sends out ARP request packets with the sender IP address set to 0.0.0.0. | 3.7.2-3.7.6 |
| 2539433 |
If multiple files reference the same module, ifupdown2 user-defined policy overrides do not apply. | 3.7.0-3.7.6 |
| 2539422 |
In FRR, you can remove the default BGP instance even if there are other instances that depend on it, which causes configuration issues. | 3.7.3-3.7.6 |
| 2539218 |
On the Mellanox SN2700 switch, the 100G-LR4 port might have problems establishing a link over a long distance (around 500 miles) through a telco service provider after a flap. If the laser is forced up by the link provider’s equipment, the circuit comes up. However, the circuit cannot survive a flap and the link remains down after a flap event. However, you might have to explicitly disable auto-negotiation and FEC in this scenario. | 3.7.2-3.7.6 |
| 2539169 |
On the QuantaMesh T1048-LY4R, smonctl reports that all power supplies are absent:
|
3.7.3-3.7.6 |
| 2538980 |
A dummy interface does not inherit the MTU from a defaults file in /etc/network/ifupdown2/policy.d. A dummy interface is typically used to keep SVI interfaces up when there are no switch ports up that are associated with that VLAN. |
3.7.2-3.7.6 |
| 2538910 |
In a layer 2 VXLAN configuration, where each ECMP path is a layer 3 LACP bond with multiple port members, ECMP hash appears fine for data traffic over VXLAN from one VTEP to another, but the LACP hash is unbalanced. | 3.7.1-3.7.6 |
| 2538756 |
When you flap a VNI with ifdown vni and ifup vni, the value of all MTUs for the SVI lowers to 1500 regardless of the default value set in the /etc/network/ifupdown2/policy.d/mtu.json file. This behavior does not occur if you flap the link with ip link set vni down. |
3.7.2-3.7.6 |
| 2537806 |
Bridging ISIS traffic fails because layer 2 cache rules forward ISIS traffic to the CPU, where it is then dropped. To work around this issue, contact Customer Support. |
3.7.2-3.7.6 |
| 2536266 |
When a VXLAN SVI transitions to a non-VXLAN SVI, the associated VRRP MAC addresses are not removed. After the transition happens, the removal fails as the VXLAN context is lost and you see the following switchd error:
|
3.7.5-3.7.6 |
| 2535795 |
The Trident3 switch does not send out sflow flow samples; only counter samples are sent. |
3.7.6 |
| 2534134 |
During system boot, Cumulus Linux reads the /etc/cumulus/ports.conf file to obtain the port speed. The port speed is programmed into the ASIC and synchronized to the kernel. After system boot, the kernel speed shows correctly as it matches the ASIC speed that is derived from the /etc/cumulus/ports.conf file and the cable type. However, if you restart switchd without rebooting the system, switchd synchronizes the speed from the kernel and uses it to program the ASIC. When you change the port speed in the /etc/cumulus/ports.conf file to ether a higher or lower speed (for example from 100G to 40G or from 40G to 100G) and the attached cable can support both speeds, the pre-existing speed is synchronized from the kernel. Consequently, the kernel speed remains at the pre-existing (incorrect) speed. |
|
| 2534100 |
The clagd process might occasionally leak memory, eventually crash, and then restart. During this time, traffic flows over this switch are impacted temporarily. The /var/log/clagd.log file shows a message similar to the following:
|
|
| 2532924 |
The NetQ agent is bundled with Cumulus VX 3.4.3 and later; however, the NetQ agent is not bundled with Cumulus Linux 3.4.3 and later. The NetQ agent has been removed from Cumulus VX 3.7.7. The NetQ agent will be bundled with Cumulus Linux in a future release. | 3.7.0-3.7.6 |
| 2528678 |
On Dell S6000 switches, switchd CPU utilization is high (50% and above) even when there is no configuration and it is idle. |
|
| 2526630 |
When link pause or priority flow control (PFC) is enabled on a Broadcom Tomahawk-based switch and there is over-subscription on a link, the ASIC sends pause frames aggressively, causing the upstream switch to not throttle enough. If you need link pause or PFC functionality, you must use a switch that does not use the Tomahawk ASIC. |
3.7.6 Release Notes
Open Issues in 3.7.6
| Issue ID | Description | Affects | Fixed |
|---|---|---|---|
| 3410952 |
If MLAG is configured but disconnected from an MLAG peer for an extended period of time (days or more), there is a long delay (up to a minute per day) before traffic forwarding stabilizes after the MLAG peer connection re-establishes. | 3.7.0-4.3.1 | 4.3.2-4.4.5, 5.5.0-5.15.0 |
| 3376798 |
On Broadcom switches, Cumulus Linux does not create the hardware bridging domain for a traditional bridge with a VXLAN interface during switchd restart. The /var/log/switchd.log file includes the following exception logs shortly after switchd restarts:switchd[30158]: hal_bcm_l3.c:1617 find_egr_path_if_vxlan_overlay:vxlan overlay : nh PORT: port <#>, vlanMAC learning looks correct, but traffic does not flow as expected. |
3.7.0-4.3.1 | 4.3.2-4.4.5 |
| 3330705 |
When using TACACS+, a TACACS+ server name that returns more than one IP address, such as an IPv6 and IPv4 address, is counted many times against the limit of seven TACACS+ servers, which might cause some of the later listed servers to be ignored as over the limit. To work around this issue, you can set the prefer_ip_version configuration option (the default value is 4) to choose between an IPv4 or IPv6 address if both are present. |
3.7.0-5.3.1 | 5.4.0-5.15.0 |
| 3327477 |
If you use su to change to a user specified through TACACS+, the user becomes the local tacacs0 thru tacacs15 user instead of the named user to run sudo commands. As a result, the named user password might not match the local tacacs0 thru tacacs15 user password. |
3.7.0-3.7.16, 4.0.0-4.4.5, 5.0.0-5.15.0 | |
| 3216921 |
RADIUS authenticated users with read-only access to NCLU commands (users in the users_with_show list) can run edit commands if a username for a non-local account is on the users_with_edit line of the /etc/netd.conf file. To work around this issue, make sure that all usernames on the users_with_edit line of the /etc/netd.conf file are configured local users for the system (real Linux users) |
3.7.0-3.7.16, 4.3.0-4.4.5 | |
| 3209699 |
RADIUS authenticated users with read-only access to NCLU commands (users in the users_with_show list) can run edit commands if a username for a non-local account is on the users_with_edit line of the /etc/netd.conf file. To work around this issue, make sure that all usernames on the users_with_edit line of the /etc/netd.conf file are configured local users for the system (real Linux users) |
3.7.0-4.3.0, 4.4.0-5.2.1 | 4.3.1, 5.3.0-5.15.0 |
| 2552739 |
Counters for IPROUTER rules do not increase when traffic is forwarded to the CPU because there is no IP neighbor. | 3.7.2-3.7.16 | |
| 2551675 |
When you restart clagd, the edge port setting on the peer link changes. |
3.7.2-4.2.0 | 4.2.1-4.4.5 |
| 2550323 |
After a neighbor is removed, the redistributed neighbor entry is withdrawn from the BGP table, but the prefix might still be selected as the bestpath when the host’s originated prefix is not advertised. To work around this issue, recreate the neighbor entry and flap the interface to the host. Or, if the host is already down, manually create a neighbor entry with an invalid MAC address, which forces redistribute neighbor to re-withdraw the entry. |
3.7.3-3.7.16 | 4.0.0-4.4.5 |
| 2548475 |
After you add a new VNI and a layer 3 SVI to a set of leafs, certain leafs might not be able to communicate on the layer 3 VNI. To work around this issue, reboot the leaf switch or restart switchd. |
3.7.6-3.7.16 | 4.0.0-4.4.5 |
| 2548382 |
The QuantaMesh BMS T3048-LY8 switch shows a low fan RPM in syslog. | 3.7.5-3.7.12, 4.0.0-4.1.1 | 3.7.13-3.7.16, 4.2.0-4.4.5 |
| 2548243 |
On switches with the Trident2+ ASIC, adding SPAN rules disables PBR rules. | 3.7.3-3.7.16, 4.0.0-4.4.5 | |
| 2547769 |
syslog might report a high load average with the CPU running a later microcode revision. |
3.7.4-3.7.12 | 3.7.13-3.7.16 |
| 2546998 |
When you configure Cumulus Linux with a /32 address on a switch port with a configured peer address (for example, to connect to a device using IP unnumbered), the switch sends GARPs for the peer address. | 3.7.5-3.7.11 | 3.7.12-3.7.16, 4.1.0-4.4.5 |
| 2546868 |
Broadcom Field Alert - SID - MMU 2B Errors A few of the MMU memories on Broadcom switches are grouped together with single parity control. During SER correction when a parity error occurs on one of those groups, other memory in that group might also report a SER error. This occurs when the memory is accessed either by a packet hit or through a schan operation. This issue can cause SER errors in other memory and cause traffic mis-forwarding or a packet drop. |
3.7.0-3.7.11, 4.0.0-4.0.1 | 3.7.12-3.7.16, 4.1.0-4.4.5 |
| 2546702 |
The FRR cl-support module times out on switches on the ARM platform even when the switch is not under heavy load. To work around this issue, run the cl-support -M command to disable timeouts. |
3.7.0-3.7.11, 4.0.0-4.0.1 | 3.7.12-3.7.16, 4.1.0-4.4.5 |
| 2546385 |
SNMP ifLastChange reports link transitions when there are none. | 3.7.6-3.7.16 | |
| 2545599 |
IPv6 table rules might affect forwarding. For example, if you create the following rule in the /etc/cumulus/acl/policy.d/03-sshd.rules file, the rule counter increments but IPv4 SSH traffic might be dropped.
|
3.7.2-3.7.11, 4.0.0-4.0.1 | 3.7.12-3.7.16, 4.1.0-4.4.5 |
| 2545405 |
The ospfd daemon might crash with the following kernel trace:
|
3.7.6-3.7.10 | 3.7.11-3.7.16 |
| 2545235 |
On the Edgecore AS6812 switch, you might see rare I2C errors. | 3.7.2-3.7.10, 4.0.0-4.0.1 | 3.7.11-3.7.16, 4.1.0-4.4.5 |
| 2545132 |
On the Mellanox switch, ACL lookups are performed for VLAN matches when no rules with UNTAGGED match are present. |
3.7.2-3.7.10, 4.0.0-4.0.1 | 3.7.11-3.7.16, 4.1.0-4.4.5 |
| 2544723 |
Setting ProtoDown on ports populated with SFP modules providing RJ-45 1000BASE-T interfaces does not cause the carrier to be dropped. The kernel shows carrier down; however, the remote device still shows a link. | 3.7.6-3.7.10, 4.0.0-4.4.5 | 3.7.11-3.7.16 |
| 2544385 |
The QCT QuantaMesh BMS T7032-IX7 switch may report “failed to request GPIO pin” errors during the boot up. | 3.7.5-3.7.10 | 3.7.11-3.7.16 |
| 2544311 |
Applying a policy-based routing (PBR) rule for all traffic from a host might disrupt ARP refresh for that connected host. | 3.7.5-3.7.16, 4.0.0-4.4.5 | |
| 2544212 |
Cumulus Linux poed generates excessive debug log entries. These will be reduced in a future release. | 3.7.3-3.7.10, 4.0.0-4.0.1 | 3.7.11-3.7.16, 4.1.0-4.4.5 |
| 2544155 |
NCLU requires you to specify an interface with multiple address-virtual statements in ascending MAC address order. |
3.7.5-3.7.16, 4.0.0-4.4.5 | |
| 2543875 |
On the Mellanox Spectrum switch, a route withdrawal might cause the associated next hop neighbor entry to be deleted in hardware but remain in the kernel. This can cause traffic going through the directly connected route to the removed neighbor entry to be forwarded to the CPU. | 3.7.6-3.7.16 | 4.0.0-4.4.5 |
| 2543840 |
On the Mellanox SN2700 switch, you cannot enable resilient hashing (RASH) and set the bucket size to 64 in the traffic.conf file. |
3.7.6-3.7.16 | |
| 2543816 |
On the Dell S5248F-ON switch, smond might generate syslog messages indicating that the fan input RPM is lower than the normal low speed of 2500 RPM. Speeds as low as 1700 RPM are acceptable in normal thermal environments; therefore, you can ignore these messages. |
3.7.6-3.7.11, 4.0.0-4.4.5 | 3.7.12-3.7.16 |
| 2543727 |
ACL rules, such as the following, fail to install if you use swp+ (interfaces mentioned as wildcards).
You can now install such rules with swp+. |
3.7.3-3.7.16 | 4.0.0-4.4.5 |
| 2543667 |
On the EdgeCore AS4610 switch, the ping command fails unless you run the command with sudo. To work around this issue, run the following commands:
Run the following command to verify the workaround:
You should see the following output:
|
3.7.6-3.7.10, 4.1.0-4.1.1 | 3.7.11-3.7.16, 4.2.0-4.4.5 |
| 2543648 |
You cannot specify a source and destination MAC address in an ERSPAN ebtables rule. For example, the following rule does not work:
|
3.7.6-3.7.12, 4.0.0-4.1.1 | 3.7.13-3.7.16, 4.2.0-4.4.5 |
| 2543647 |
ERSPAN in ebtables does not work for VNIs. For example, the following rule does not work:
|
3.7.6-4.2.1 | 4.3.0-4.4.5 |
| 2543646 |
In an ebtables rule, ERSPAN (upper case) does not work. You need to specify erspan (lower case). | 3.7.6-3.7.16, 4.0.0-4.4.5 | |
| 2543473 |
Configuring an inbound route map to manually change the next hop IP address received from an eBGP peer locally causes the next hop to not be updated when advertising this route out to other eBGP peers. To work around this issue, set a “dummy” route map outbound to the eBGP peer or configure the route map to manually set the next hop outbound from the originating eBGP peer. | 3.7.6-3.7.10 | 3.7.11-3.7.16 |
| 2543211 |
In some cases, the switchd service might warn of excessive MAC moves from one switch port to itself (for example, from swp18 to swp18). |
3.7.0-3.7.16, 4.0.0-4.4.5 | |
| 2543113 |
NCLU restarts FRR when attempting to remove a BGP VRF stanza. This happens regardless of whether the VRF is valid/configured elsewhere on the switch or the removal is successful. To work around this issue, remove the stanza using vtysh. |
3.7.3-3.7.16 | 4.0.0-4.4.5 |
| 2543096 |
When an SVI with a virtual MAC is configured with a layer 2 VNI in an EVPN environment, if you replace the /etc/network/interfaces file with a different file that does not have the SVI and layer 2 VNI configuration, the original virtual MAC is not populated through the EVPN route until FRR is restarted. |
3.7.6-3.7.16, 4.0.0-4.4.5 | |
| 2543052 |
Received EVPN type-5 and type-2 MACIP routes are not installed in the kernel (and hardware) routing tables for the associated VRF, which causes traffic to be blackholed. The failure to install the default route causes complete reachability failure for the particular tenant on the affected racks. The routes that are not installed are seen as “inactive” in the routing subsystem (FRR) VRF routing table. This problem is rare and can occur only in EVPN configurations that have user-configured route targets (RTs) for tenant VRFs, and only following a restart of FRR. To work around this issue, either restart the FRR service on the affected switch with the sudo systemctl restart frr.service command or bounce the layer 3 SVI for the affected VRF; for example:
You can run the net show vrf vni command to print a mapping of VRF : L3-VNI : L3-SVI. |
3.7.5-3.7.16 | 4.0.0-4.4.5 |
| 2543044 |
Under certain conditions, EVPN next hops might not be removed when the contributing peer goes down or might not be populated when the BGP session to the contributing peer comes up. You can prevent EVPN next hops from not being removed when the contributing peer goes down by specifying static MAC addresses on all layer 3 VNIs. There is no workaround for preventing EVPN next hops from not being populated when the BGP session to the contributing peer comes up. |
3.7.2-3.7.16 | 4.0.0-4.4.5 |
| 2542945 |
On the Broadcom Maverick switch with a QinQ configuration, the packets coming into the CPU might be tagged incorrectly; for example, 802.1ad + 802.1q tags are expected in the packets but the packets have 802.1q + 802.1q tags. To work around this issue, configure the bridge with bridge-vlan-protocol 802.1ad:
|
3.7.6-3.7.16, 4.0.0-4.4.5 | |
| 2542913 |
IF-MIB::ifHCInOctets reports significantly lower values than reported by interface counters seen elsewhere. | 3.7.6-3.7.16 | 4.0.0-4.4.5 |
| 2542871 |
After you issue the NCLU net del bgp vrf command and commit the change, Cumulus Linux does not remove the configuration from the /etc/frr/frr.conf file or the net show config commands. |
3.7.3-3.7.10, 4.0.0-4.0.1 | 3.7.11-3.7.16, 4.1.0-4.4.5 |
| 2542853 |
For interfaces configured with RS FEC, when switchd is restarted, the link goes down but does not automatically come back up. This occurs because the FEC status is not replayed correctly into the kernel. To work around this issue, run the ifreload -a command to bring up the interface after switchd is restarted. |
3.7.6-3.7.8 | 3.7.9-3.7.16 |
| 2542837 |
On Mellanox switches, policer iptables are not working as expected. For example, when using a policer with mode KB/MB/GB to rate-limit interfaces, the syntax is accepted but the data plane transfer speed is not affected by the rule. | 3.7.6-3.7.8, 4.0.0-4.4.5 | 3.7.9-3.7.16 |
| 2542835 |
snmpd fails because NCLU does not remove agentaddress @vrf lines when running the net add snmp-server listening-address all command. |
3.7.4-3.7.16 | 4.0.0-4.4.5 |
| 2542823 |
On the Broadcom Trident 3 switch, VXLAN encapsulated packets are dropped on the ingress port (tagged layer 2 port) during transit forwarding (the local switch does not terminate the VXLAN tunnel). An example of where this two-layer VXLAN inside VXLAN encapsulation might occur: - VXLAN tunnel (#1) between two servers (different racks) to provide layer 2 extension for containers or VM hosts. - VXLAN tunnel (#2) between the TOR switch in rack 1 to the TOR switch located in the remote rack. To work around this issue, either: - Configure the edge port (facing the servers) to be an access port (instead of a trunk/tagged port) - Change the destination port from 4789 to something else (VXLAN tunnel terminated by the servers) |
3.7.5-3.7.11, 4.0.0-4.0.1 | 3.7.12-3.7.16, 4.1.0-4.4.5 |
| 2542774 |
When moving an IP address from the address line to inet dhcp, then issuing the ifreload -a command, the old address is not removed from the interface. NCLU still reports the old address only and reports it as a DHCP address. |
3.7.6-3.7.8 | 3.7.9-3.7.16 |
| 2542767 |
If the BMC operating system fails to respond to IPMI, you see a traceback in bmcd and all the sensors might report ABSENT devices in smonctl. To work around this issue, power cycle the switch. |
3.7.6-4.0.1 | 4.1.0-4.4.5 |
| 2542765 |
When you configure the switch to send an EAP request with the net add dot1x send-eap-request-id command, the switch ignores re-authentication attempts and does not send back an EAPol. |
3.7.6-3.7.10 | 3.7.11-3.7.16 |
| 2542726 |
After configuring switchd hal.bcm.per_vlan_router_mac_lookup to TRUE on a Broadcom switch, layer 2 traffic works over VXLAN but the host is not able to ping the locally connected gateway and loses routing ability to other IPs and subnets. |
3.7.5-3.7.8 | 3.7.9-3.7.16 |
| 2542711 |
BGP update packets are sometimes missing the mandatory nexthop attribute, which causes connections to reset. For example, this issue is seen when using VRF route leaking with a mix of BGP unnumbered and BGP numbered peers. |
3.7.6-3.7.8 | 3.7.9-3.7.16 |
| 2542509 |
In EVPN symmetric or centralized configurations with BGP peering over a peer link, VXLAN routed packets transiting an MLAG peer are dropped until the clagd init-delay timer expires during the bring-up sequence following a reboot.The problem is caused by a race condition when programming the anycast IP address (used to terminate VXLAN tunnels), where the hardware is programmed before the software by clagd.To work around this issue, configure the BGP path across the peer link to be less preferred. The example below uses AS path prepending and the MLAG switches are iBGP neighbors. However, other BGP configurations achieve the same result. In the /etc/frr/frr.conf file, make a new AS path access list and route map to apply BGP pre-pending of the local ASN one or more times. For example:
|
3.7.6-3.7.10, 4.0.0-4.0.1 | 3.7.11-3.7.16, 4.1.0-4.4.5 |
| 2542480 |
When BGP remove-private-AS replace-AS is configured under the BGP IPv4 or IPv6 address family between a pair of switches configured as BGP peers, a BGP route update might cause the BGP session to flap. To work around this issue, do not configure remove-private-AS replace-AS in the BGP IPv4 or IPv6 address family. |
3.7.6-3.7.8 | 3.7.9-3.7.16 |
| 2542384 |
When you define a trap destination using @mgmt, snmpd indicates that the network is unreachable even though the IP address is reachable in the management VRF. To work around this issue, remove @mgmt vrf references in the /etc/snmp/snmpd.conf file, stop snmpd, then start snmpd manually in the management VRF with the systemctl start snmpd@mgmt command. |
3.7.6-3.7.16 | 4.0.0-4.4.5 |
| 2542365 |
The snmpd service frequently crashes due to double free or corruption. |
3.7.6-3.7.8 | 3.7.9-3.7.16 |
| 2542338 |
In a typical CLOS network, each leaf is connected to all spine nodes; VXLAN packets follow leaf-spine links. However certain failure scenarios or maintenance activity might result in the MLAG primary switch being isolated from the spine layer (the only available network path is now across the peer link). As a result, the MLAG primary switch fails to transmit VXLAN encapsulated packets out on the peer link. It is also possible for the MLAG secondary switch to be isolated from the spine layer and then the problem is seen on the MLAG secondary switch. The issue occurs because the Broadcom Trident3 switch does not perform VLAN translation for VXLAN encapsulated packets where the tunnel is not terminated. To work around this issue, configure the BGP peering on a new VLAN interface (for example, vlan4093) instead of the peer link sub-interface (peerlink.4094). |
3.7.6 | 3.7.7-3.7.16, 4.0.0-4.4.5 |
| 2542336 |
On the Mellanox SN2410 switch, switchd does not start. |
3.7.2-3.7.8 | 3.7.9-3.7.16 |
| 2542310 |
hsflow disregards the setting for agent.cidr in the /etc/hsflowd.conf file and selects an IPv6 agent address. The source IP address of the hsflowd packet is IPv4, but the agent address in the hsflow payload shows IPv6. |
3.7.6-3.7.16 | |
| 2542309 |
When all ports are split into 4X on the EdgeCore AS7726 switch, switchd fails to start up and a crash is seen in syslog. |
3.7.5-3.7.6 | 3.7.7-3.7.16 |
| 2542305 |
If an SVI exists in the configuration before you assign it an IP address, when you do assign the IP address with the NCLU command, the vlan-id and the raw-device bridge stanzas are not added automatically. |
3.7.6-3.7.16, 4.0.0-4.4.5 | |
| 2542301 |
When first creating a bond and enslaving an interface, NCLU hides some of the bridge command suggestions, although they are still accepted. |
3.7.3-3.7.16, 4.0.0-4.4.5 | |
| 2542297 |
When you run the NCLU net del all command, the exec-timeout setting changes in the /etc/frr.frr.conf file. |
3.7.6-3.7.8 | 3.7.9-3.7.16 |
| 2542248 |
When you generate a cl-support file, clagd.service prints log messages similar to the following:
|
3.7.6-3.7.16 | 4.0.0-4.4.5 |
| 2542193 |
When you configure the link-down yes attribute to a physical SVI, the VRR (-v0) interface is not brought down, and the locally-connected subnet can still be redistributed into routing protocols and advertised to neighbors despite the physical SVI being administratively down. To work around this issue, manually bring down the VRR (-v0) interface with the ip link set dev command. For example:
|
3.7.6-3.7.8 | 3.7.9-3.7.16 |
| 2542058 |
The ifquery command should return a non-zero value if there is a syntax error. However, it currently returns zero. This issue affects automation scripts that validate a file before copying it into place. |
3.7.6-3.7.8 | 3.7.9-3.7.16 |
| 2542031 |
If you configure a sys-mac with a single digit, ifreload -a does not indicate that the MAC address is invalid for the MLAG sys-mac and the clagd process fails silently. |
3.7.6-3.7.8 | 3.7.9-3.7.16 |
| 2541924 |
If the address-virtual MAC address is missing a leading zero in the last octet, the interface bounces. |
3.7.6-3.7.8 | 3.7.9-3.7.16 |
| 2541869 |
SNMP shows 0 for all swp interfaces in the ifSpeed field (bond interfaces, lo and eth0 are not affected and show a value). |
3.7.6-3.7.16 | |
| 2541791 |
In Cumulus Linux 3.7.6 and earlier, ifupdown2 does a string comparison to see if two addresses are the same. In Cumulus Linux 3.7.7, ifupdown2 does an integer comparison. For example, in Cumulus Linux 3.7.6 and earlier, hwaddress 00:00:5e:62:f8:02 and hwaddress 00:00:5e:62:f8:2 are not considered to be equal. In Cumulus Linux 3.7.7 and later, they are considered equal since 2 implies a leading zero. |
3.7.5-3.7.6 | 3.7.7-3.7.16 |
| 2541761 |
A TACACS privilege level 15 user mapped to tacacs15 cannot use net commands even though the user is part of the netedit and/or netshow user group. |
3.7.2-3.7.6 | 3.7.7-3.7.16 |
| 2541749 |
In a highly-scaled environment, while BGP is undergoing initial convergence, watchfrr times out and bgpd stops responding. |
3.7.5-3.7.6 | 3.7.7-3.7.16 |
| 2541685 |
If you have a configuration with more than 128 VRFs, BGP routes stop advertising. | 3.7.6 | 3.7.7-3.7.16 |
| 2541654 |
On the Dell N3048EP switch, the I2C bus might lock and when you log into the console, you see the following message. bcm-iproc-i2c 1803b000.i2c: bus is busy As a result, temperatures cannot be monitored. However, traffic is not affected (links do not go down). |
3.7.6 | 3.7.7-3.7.16 |
| 2541645 |
Received EVPN type-5 routes are not installed into the kernel VRF routing table even though the route appears to be correct. The failure to install the default route makes the rack unreachable from the external world. | 3.7.5-3.7.16 | |
| 2541604 |
The snmpd service exits with a message similar to the following:
This problem might occur during or after network convergence events. For example, when bgpd needs to process a high number of updates and the CPU cannot keep up, bgpd is disconnected and agentx generates a core dump in snmpd due to a memory allocation problem. To work around this issue, disable agentx by commenting out the following lines in the /etc/snmp/snmpd.conf file. Then, restart the snmpd service with the systemctl restart snmpd command.
If you still want to poll the BGP4-MIB information, re-enable the bgp pass persist script by adding the following line in the /etc/snmp/snmpd.conf file:
|
3.7.2-3.7.8 | 3.7.9-3.7.16 |
| 2541505 |
The vtep-ctl list-ports returns ports with the fully qualified domain name of the switch instead of the short hostname. |
3.7.6 | 3.7.7-3.7.16 |
| 2541494 |
Under certain circumstances (when you reboot or restart the switchd service), a race condition might occur which causes a synchronization issue resulting in hardware misprogramming of the VXLAN tunnel endpoint interface (VTEP). Packets destined out this tunnel are dropped in the egress direction. Packets arriving on this tunnel are dropped in the ingress direction. This is due to a race condition between ASIC and kernel programming that causes the kernel to incorrectly process the link state of a VXLAN interface. To work around this issue, you can bounce the layer 3 SVI for the affected VRF. For example:
Run the net show vrf vni command to show a mapping of the layer 3 VNI to layer 3 SVI for the VRF. Note: This workaround is not guaranteed because the race condition cannot be always be avoided. |
3.7.4-3.7.16 | |
| 2541294 |
In an EVPN configuration, the old MAC/IP route is present in the routing table after an IP mobility event. | 3.7.5-3.7.16 | |
| 2541213 |
On Trident2 switches, egress double-tagged frames incorrectly use 802.1Q outer ethertype instead of 802.1AD. | 3.7.5-3.7.6 | 3.7.7-3.7.16 |
| 2541212 |
The maximum-prefix configuration under the IPv4 address family has an optional restart value, which you can configure. This configuration is ignored and, instead of restarting the sessions every x minutes, the peer constantly changes between established and idle due to the prefix count being exceeded. |
3.7.5-3.7.16, 4.0.0-4.4.5 | |
| 2541165 |
On the Dell N3048EP-ON switch, UPOE is supported only on ports 1 thru 12. (UPOE uses all four pairs of standard Ethernet cabling whereas PoE delivers power over two twisted pairs.) When you plug a UPOE device in a port higher than port 12, poectl reports that four_pair_mode_enabled is true. However, this configuration is not supported on the port so poectl should report that four_pair_mode_enabled is false. |
3.7.6-3.7.16 | |
| 2541107 |
The poectl -j command output does not show the correct port numbering in JSON; it is off by one. |
3.7.6 | 3.7.7-3.7.16 |
| 2541095 |
The RADIUS AAA client does the source IP address bind first, then the setsockopt VRF, which causes a failure due to a kernel check for an address mismatch with the VRF. |
3.7.4-3.7.6 | 3.7.7-3.7.16 |
| 2541090 |
The dhcrelay service crashes when the DHCP relay packet comes back from the server. To work around this issue, remove the –nl flag from the dhcrelay service. |
3.7.3-3.7.6 | 3.7.7-3.7.16 |
| 2541029 |
On switches with the Trident2 ASIC, 802.1Q-encapsulated control plane traffic received on an interface with 802.1AD configured subinterfaces might be dropped. This issue only affects QinQ configurations. |
3.7.5-3.7.16, 4.0.0-4.4.5 | |
| 2540980 |
After upgrading the BIOS to 3.21.0.0-6, when you run the reboot, shutdown or init commands with certain options, the switch powers off. To determine the BIOS version of the switch, run:
|
3.7.5-3.7.6 | 3.7.7-3.7.16 |
| 2540950 |
On the QuantaMesh T4048-IX8 or EdgeCore AS7326-56X switch, when using a 1000BASE-T SFP module, the module LEDs do not light to reflect link status. |
3.7.3-4.1.1 | 4.2.0-4.4.5 |
| 2540895 |
On the EdgeCore AS4610-54P switch, at any moment and without warning, your PoE devices might all go down as PoEd crashes and an error message might be logged. There is no functional impact after a restart. | 3.7.6 | 3.7.7-3.7.16 |
| 2540863 |
On the EdgeCore AS5812-54X switch, the PSU2 Fan1 fluctuates between OK and LOW. When the fan speed is reported as LOW, the RPM is shown as a negative number. |
3.7.3-3.7.16 | |
| 2540843 |
On the Dell S3048 switch, ports with FEC disabled show as BaseR on boot up. | 3.7.3-3.7.6 | 3.7.7-3.7.16 |
| 2540830 |
On the Dell S5248F switch, packets forwarded to the CPU are corrupted. | 3.7.3-3.7.16 | |
| 2540823 |
On the EdgeCore 7326-54X switch, switchd does not start on initial install because the decode-syseeprom command fails. However in ONIE, onie-syseeprom has no issues. |
3.7.5-3.7.6 | 3.7.7-3.7.16 |
| 2540753 |
If the interface alias contains a single or double quotation mark, or an apostrophe, the net show configuration commands fail with the following error:
|
3.7.5-3.7.16, 4.0.0-4.4.5 | |
| 2540737 |
When you commit a configuration change to a VXLAN layer 2 VNI in an MLAG configuration, the peer link on the MLAG secondary switch goes into an STP blocking state. | 3.7.2-3.7.6 | 3.7.7-3.7.16 |
| 2540721 |
If you modify BFD timers in the /etc/frr/frr.conf file, then run the systemctl reload frr command, the neighbor connections flap. |
3.7.4-3.7.6 | 3.7.7-3.7.16 |
| 2540684 |
On a Dell S5248F (Trident3) switch, packets from switch ports are forwarded to the CPU and are sometimes corrupted. The corruption might result in BGP peerings being down, which can lead to all VXLAN traffic to and from a node to be lost, causing an outage to dually connected hosts in a rack. To work around this issue, restart switchd. |
3.7.3-3.7.8 | 3.7.9-3.7.16, 4.0.0-4.4.5 |
| 2540600 |
If the clagd-vxlan-anycast-ip is removed from the /etc/network/interfaces file (either with the NCLU command or by editing the file manually), MLAG still believes it is present until clagd restarts. |
3.7.3-3.7.8 | 3.7.9-3.7.16, 4.0.0-4.4.5 |
| 2540557 |
On Trident3 switches, transit packets larger than 1500 bytes(DF) routed between SVIs is unexpectedly forwarded to the CPU even when the MTU is greater than 9000. This severely limits throughput for routed jumbo frames as packets arriving at a high interval are dropped to the CPU. | 3.7.0-3.7.16 | |
| 2540464 |
If you have dynamic route leaking configured between any two VRFs and the BGP instance for the default VRF is not defined, removing an import vrf statement crashes bgpd. This occurs even if neither of the leaking VRFs are the default VRF. |
3.7.4-3.7.6 | 3.7.7-3.7.16 |
| 2540444 |
SNMP incorrectly requires engine ID specification. |
3.7.4-3.7.16, 4.0.0-4.4.5 | |
| 2540359 |
bgpd creates a core dump at zclient_send_interface_radv_req. This is an issue with how FRRouting checks next hops and has been pushed upstream to FRRouting. |
3.7.6-3.7.8 | 3.7.9-3.7.16 |
| 2540352 |
When you use NCLU to configure a route map, the parser allows for glob matching of interfaces for a match interface condition when there can only be a single interface matched. The proper syntax is to use multiple route map clauses, each matching a single interface, instead of a single clause matching multiple interfaces. For example, this command is incorrect:
These commands are correct:
|
3.7.2-3.7.16, 4.0.0-4.4.5 | |
| 2540340 |
NCLU allows for the configuration of addresses on VRF interfaces, but tab completion for the net add vrf command just displays
Tab completion for the net add vrf command works correctly. |
3.7.4-3.7.16, 4.0.0-4.4.5 | |
| 2540274 |
On the Maverick switch, CPU forwarded packets might be dropped when there is no route to a leaked host route. | 3.7.5-3.7.16, 4.0.0-4.4.5 | |
| 2540268 |
An incorrect readout of the optical transceiver high temperature alarm threshold (read as 17 degrees centigrade), disables a 100G optical module on Mellanox Spectrum switches. | 3.7.2-3.7.6 | 3.7.7-3.7.16 |
| 2540204 |
When links come up after FRR is started, VRF connected routes do not get redistributed. | 3.7.4-3.7.16, 4.0.0-4.4.5 | |
| 2540192 |
The net del bridge bridge mcsnoop yes command does not return the value to the default of disabled. To work around this issue, use the net add bridge bridge mcsnoop no command to delete the mcsnoop attribute and return to the default value. |
3.7.4-3.7.16, 4.0.0-4.4.5 | |
| 2540155 |
On the Broadcom switch, when moving configuration from bridged to routed (or toggling from routed to bridged to routed), some traffic is not seen by the kernel. This can cause BGP to not establish on a transit node. |
3.7.3-3.7.16, 4.0.0-4.4.5 | |
| 2540042 |
When you try to configure the VRRP priority and advertisement-interval with NCLU on a traditional mode bridge, the net commit command fails. To work around this issue, use the vtysh command (inside FRR) to change the VRRP priority or advertisement-interval on traditional bridges. For example:
|
3.7.4-3.7.16, 4.0.0-4.4.5 | |
| 2540041 |
On SVIs in a VLAN-aware bridge, you cannot change the VRRP priority with NCLU. To work around this issue, run the vtysh command inside FRR to change the default priority. For example:
|
3.7.4-3.7.16, 4.0.0-4.4.5 | |
| 2540040 |
Cumulus Linux uses VRRPv3 as the default version, and enables both preempt and accept mode by default. You cannot change these default values with NCLU. To work around this issue, run the vtysh commands (inside FRR) to change the default values. For example:
|
3.7.4-3.7.16, 4.0.0-4.4.5 | |
| 2540031 |
NCLU does not honor auto all in the /etc/network/interfaces file and removes the existing configuration if no individual auto lines exist. |
3.7.3-3.7.16, 4.0.0-4.4.5 | |
| 2540017 |
The net commit command fails when you try to add a static voice VLAN or delete dot1x configuration for an interface when the port is already authorized. |
3.7.4-3.7.6 | 3.7.7-3.7.16 |
| 2539994 |
When you try to remove a BGP peer group configuration with NCLU, the command fails but no warning message is shown. For example:
|
3.7.2-3.7.16, 4.0.0-4.4.5 | |
| 2539962 |
When an LDAP user that does not have NCLU privileges (either in the netshow or netedit group, or in the /etc/netd.conf file) runs an NCLU command, a traceback occurs instead of a permissions error. |
3.7.0-3.7.16, 4.0.0-4.4.5 | |
| 2539928 |
When you delete or add 802.1X configuration on a port in a traditional mode bridge, all the ports are removed from the bridge. | 3.7.4-3.7.6 | 3.7.7-3.7.16 |
| 2539686 |
The Cumulus Linux switch sometimes sends out ARP request packets with the sender IP address set to 0.0.0.0. | 3.7.2-3.7.6 | 3.7.7-3.7.16 |
| 2539670 |
On the Edgecore 4610-54P switch, automatic medium-dependent interface crossover (auto-MDIX) stops working on a 100M full duplex interface and does not detect the required cable connection type. |
3.7.2-3.7.16, 4.0.0-4.4.5 | |
| 2539433 |
If multiple files reference the same module, ifupdown2 user-defined policy overrides do not apply. | 3.7.0-3.7.6 | 3.7.7-3.7.16 |
| 2539422 |
In FRR, you can remove the default BGP instance even if there are other instances that depend on it, which causes configuration issues. | 3.7.3-3.7.6 | 3.7.7-3.7.16 |
| 2539218 |
On the Mellanox SN2700 switch, the 100G-LR4 port might have problems establishing a link over a long distance (around 500 miles) through a telco service provider after a flap. If the laser is forced up by the link provider’s equipment, the circuit comes up. However, the circuit cannot survive a flap and the link remains down after a flap event. However, you might have to explicitly disable auto-negotiation and FEC in this scenario. | 3.7.2-3.7.6 | 3.7.7-3.7.16 |
| 2539169 |
On the QuantaMesh T1048-LY4R, smonctl reports that all power supplies are absent:
|
3.7.3-3.7.6 | 3.7.7-3.7.16 |
| 2539124 |
The net add interface command adds no ptm-enable for that interface in the frr.conf file. Running the net add or the net del command does not remove no ptm-enable from the frr.conf file. You have to remove it manually using vtysh. |
3.7.2-3.7.16, 4.0.0-4.4.5 | |
| 2539081 |
When you delete post-up and pre-down IP peer entries from the etc/network/interfaces file, then run the ifreload command, the IP addresses are not removed and the route remains in the route table. To work around this issue, either delete the IP addresses without the /32 mask component or flush the IP addresses for the interface with the ip addr flush dev command. |
3.7.0-3.7.16 | 4.0.0-4.4.5 |
| 2538980 |
A dummy interface does not inherit the MTU from a defaults file in /etc/network/ifupdown2/policy.d. A dummy interface is typically used to keep SVI interfaces up when there are no switch ports up that are associated with that VLAN. |
3.7.2-3.7.6 | 3.7.7-3.7.16 |
| 2538910 |
In a layer 2 VXLAN configuration, where each ECMP path is a layer 3 LACP bond with multiple port members, ECMP hash appears fine for data traffic over VXLAN from one VTEP to another, but the LACP hash is unbalanced. | 3.7.1-3.7.6 | 3.7.7-3.7.16 |
| 2538875 |
IPv6 multicast traffic destined to an unregistered multicast group is flooded to all ports in a bridge despite the bridge.optimized_mcast_flood = TRUE setting in the /etc/cumulus/swichd.conf file. |
3.7.2-3.7.16 | |
| 2538790 |
NCLU automatically adds the VLAN ID (for the layer 3 VNI/SVI) to the bridge when you run net add vxlan . This configuration breaks network connectivity in an EVPN symmetric routing configuration using MLAG. To restore connectivity, remove the VLAN ID from the bridge. |
3.7.2-3.7.16, 4.0.0-4.4.5 | |
| 2538756 |
When you flap a VNI with ifdown vni and ifup vni, the value of all MTUs for the SVI lowers to 1500 regardless of the default value set in the /etc/network/ifupdown2/policy.d/mtu.json file. This behavior does not occur if you flap the link with ip link set vni down. |
3.7.2-3.7.6 | 3.7.7-3.7.16 |
| 2538741 |
The NCLU command net show bridge spanning-tree does not show the MLAG peer link as part of the STP forwarding instance.To work around this issue, use the mstpctl command to confirm the STP status of the port. |
3.7.2-3.7.8 | 3.7.9-3.7.16 |
| 2538590 |
When you configure a control plane ACL to define permit and deny rules destined to the local switch, NCLU programs the control plane ACL rules into the FORWARD chain. |
3.7.2-3.7.16, 4.0.0-4.4.5 | |
| 2538562 |
On an RMP/1G-T switch, when you remove link-speed 100 with the NCLU command or by editing the etc/network/interfaces file to revert the 100M interface to the default (1G auto), the interface fails to recover and does not come back up.After you remove the link-speed, ethtool shows the advertised link modes as not reported and Speed/Duplex as unknown.To work around this issue and bring the interface back up, either restart switchd or use ethtool to configure the speed, advertised, duplex or MDI-X settings. Note: The advertised link mode gets set incorrectly if you include 1000baseT/Half. The port will come up successfully at 1G. |
3.7.2-3.7.16, 4.0.0-4.4.5 | |
| 2538480 |
Modifying the /etc/netd.conf file to set show_linux_command = True does not take effect. |
3.7.2-3.7.8 | 3.7.9-3.7.16 |
| 2538302 |
portwd allows an error to change the module type based on the error. For example, a bad write to a module might cause the module type to flap, which causes the link itself to flap. |
3.7.0-3.7.16 | |
| 2538294 |
If you use NCLU to create an iBGP peering across the peer link, running the net add bgp l2vpn evpn neighbor peerlink.4094 activate command creates a new eBGP neighborship when one has already been configured for iBGP. This is unexpected; the existing iBGP configuration is valid. |
3.7.0-3.7.16, 4.0.0-4.4.5 | |
| 2538256 |
On the Broadcom switch, when a link-local multicast frame is received on an access port with a VNI in the bridge, two copies of the packet are sent across the VNI to remote VTEPs and the receiving hosts observe duplicate packets. |
3.7.2-4.0.1 | 4.1.0-4.4.5 |
| 2538022 |
When you remove an interface from a bridge and add it to a VRF in the same commit/ifreload, the IPv6 link-local address is not created automatically. To work around this issue, do the change in two separate commits. First, remove the interface from the bridge, which causes it to be a layer 2 interface. Then, enslave the interface to the VRF. |
3.7.2-3.7.8 | 3.7.9-3.7.16 |
| 2537819 |
When you enable FEC (RS or BaseR) on an interface, removing the configuration from that interface does not revert the FEC status to off/none. |
3.7.2-3.7.16 | 4.0.0-4.4.5 |
| 2537806 |
Bridging ISIS traffic fails because layer 2 cache rules forward ISIS traffic to the CPU, where it is then dropped. To work around this issue, contact Customer Support. |
3.7.2-3.7.6 | 3.7.7-3.7.16 |
| 2537699 |
There is a limitation on the number of SVI interfaces you can specify as DHCP relay interfaces in the /etc/default/isc-dhcp-relay file. For example, 1500 SVI interfaces causes the dhcrelay service to exit without a core file and logs similar to the following are generated for the interfaces:
Eventually the dhcrelay service stops. |
3.7.1-3.7.16, 4.0.0-4.4.5 | |
| 2537544 |
When you run the mstpctl command, you might see the bridge-port state as blocking when it is actually disabled. You might see the same incorrect bridge-port state when other programs or tools use the output of mstpctl; for example, SNMP output from the BRIDGE-MIB. |
3.7.1-3.7.16, 4.0.0-4.4.5 | |
| 2537536 |
When FRR restarts, snmp[err] dev/kmem: Permission denied error messages are recorded in the log file and SNMPd might crash periodically. |
3.7.5-3.7.16 | 4.0.0-4.4.5 |
| 2537378 |
NCLU SNMPv3 user configuration (add, delete, modify) does not complete. Changes are made to the /etc/snmp/snmpd.conf file but the SNMPv3 user cache file /var/lib/snmp/snmpd.conf fails to update correctly and the configuration does not reflect in operation. To work around this issue, stop snmpd, remove the cache file, then restart snmpd. |
3.7.1-3.7.16 | |
| 2537188 |
When an event in the network, such as a switchd or networking service restart, leads to an OVSDB server high availability transition, an ovs-vtepd core might occur. This core generation has no effect on the functionality of high availability when the active OVSDB server is back in the network. |
3.7.2-3.7.16 | |
| 2537153 |
In rare cases, certain IPv6 BGP peers fail to reestablish after switchd restarts. |
3.7.2-3.7.8 | 3.7.9-3.7.16 |
| 2537104 |
When you try to stop hsflowd on the Trident II+ switch with the systemctl stop hsflowd command, the process hangs until you stop it with SIGKILL. |
3.7.1-3.7.16 | 4.0.0-4.4.5 |
| 2537061 |
The Dell S5048F-ON switch (with reverse airflow, rear to front), shows the Temp-3 sensor as absent. |
3.7.1-4.0.1 | 4.1.0-4.4.5 |
| 2536650 |
Mellanox Spectrum and Helix4 switches occasionally send malformed packets and do not send any flow samples (only counters). While this issue is fixed for switches with the Spectrum ASIC, this is a [known limitation|https://docs.cumulusnetworks.com/cumulus-linux/Monitoring-and-Troubleshooting/Network-Troubleshooting/Monitoring-System-Statistics-and-Network-Traffic-with-sFlow/#caveats-and-errata] on this Helix4 platform. |
3.7.0-3.7.8 | 3.7.9-3.7.16, 4.0.0-4.4.5 |
| 2536639 |
On a Dell S4048 switch, when you set the eth0 speed to 100, either with NCLU or by editing the /etc/network/interfaces file, the igb driver crashes, which brings down eth0. To work around this issue: * If eth0 is configured in the management VRF, power cycle the switch; the eth0 configuration fails and reverts back to the default (auto-negotiation/1000). * If eth0 is configured in the default VRF and you power cycle after the crash, igb continues to crash on boot up (before getting to login prompt); power-cycle the switch, select the Advanced option in GRUB to boot to recovery mode, then modify the /etc/network/interfaces file. |
3.7.0-3.7.16 | 4.0.0-4.4.5 |
| 2536608 |
Single tagged ARP requests received on a QinQ-over-VXLAN access port are dropped if ARP suppression is enabled on an unrelated VNI. |
3.7.0-3.7.16 | |
| 2536559 |
When deleting an interface using NCLU, if the /etc/network/interfaces alias is different than the /etc/frr/frr.conf description, the net commit command returns the following error:
Despite this error, the change is made and the description is removed from the frr.conf file. |
3.7.3-3.7.10 | 3.7.11-3.7.16 |
| 2536384 |
The BFD packet redirection logic used by OVSDB server high availability mode redirects BUM packets across the peer link. The iptables rule for redirection does differentiate between BFD and non-BFD VXLAN inner packets because the service node sends all frames with its own IP address as the tunnel source IP address. The VXLAN encapsulated BUM packets do not get forwarded to the CPU and do not go through the iptable redirection rule; only VXLAN encapsulated BFD packets get forwarded to the CPU due to the inner MAC DA lookup in hardware. |
3.7.0-3.7.16, 4.0.0-4.4.5 | |
| 2536266 |
When a VXLAN SVI transitions to a non-VXLAN SVI, the associated VRRP MAC addresses are not removed. After the transition happens, the removal fails as the VXLAN context is lost and you see the following switchd error:
|
3.7.5-3.7.6 | 3.7.7-3.7.16 |
| 2536230 |
On the Broadcom switch with the Trident3 ASIC, the ECN-CE bit is set by default on transit traffic. This might result in hosts adjusting traffic behavior if they are configured for the ECN feature. In Cumulus Linux 3.7.11, the default behavior changed; the ECN-CE bit is no longer set by default on transit traffic. |
3.7.3-3.7.10, 4.0.0-4.0.1 | 3.7.11-3.7.16, 4.1.0-4.4.5 |
| 2536179 |
On switches with the Trident 2+ ASIC, counters associated with VLANs and VRFs are not working. | 3.7.0-3.7.16, 4.0.0-4.4.5 | |
| 2535986 |
At a high CPU transmit traffic rate (for example, if there is unexpected CPU generated flooding or replication in software), when the ASIC packet driver cannot keep up with the transmit rate because there are no free DMA buffers, it can back pressure by suspending the switch port transmit queues. This can fill up the application socket buffers resulting in No buffer space available error messages on protocol sockets.When the driver recovers, it automatically resumes the transmit queues. In most cases these error messages are transient. In rare cases, the hardware queues might get stuck, which you can recover with a switchd restart. |
3.7.0-3.7.16, 4.0.0-4.4.5 | |
| 2535965 |
On the Trident3 switch, static PIM with IIF based on a layer 2 bridge does not work reliably. PIM Join via signaling is required for IPMC to work properly. To work around this issue, use dynamic signaling (joins) to manage IP multicast traffic. |
3.7.0-3.7.16, 4.0.0-4.4.5 | |
| 2535795 |
The Trident3 switch does not send out sflow flow samples; only counter samples are sent. |
3.7.6 | 3.7.7-3.7.16 |
| 2535209 |
The net show lldp command sometimes shows the port description in the Remote Port field. The net show interface command shows the correct value in the Remote Host field.To work around this issue, use net show interface command for LLDP output when connected to Cisco equipment. |
3.7.5-3.7.10, 4.0.0-4.4.5 | 3.7.11-3.7.16 |
| 2534450 |
The default BGP instance must be provisioned and always exist for proper operation of dynamic leaking of routes between VRFs. | 3.7.0-3.7.16 | 4.0.0-4.4.5 |
| 2532924 |
The NetQ agent is bundled with Cumulus VX 3.4.3 and later; however, the NetQ agent is not bundled with Cumulus Linux 3.4.3 and later. The NetQ agent has been removed from Cumulus VX 3.7.7. The NetQ agent will be bundled with Cumulus Linux in a future release. | 3.7.0-3.7.6 | 3.7.7-3.7.16 |
| 2528990 |
During a link flap test, you might occasionally see a message similar to: warning: swp6: netlink: cannot set link swp6 down: [Errno 98] Address already in use. |
3.7.6-3.7.10 | 3.7.11-3.7.16 |
Fixed Issues in 3.7.6
| Issue ID | Description | Affects |
|---|---|---|
| 2541362 |
If you configure bridge-learning off on a host-facing link in a VXLAN/EVPN environment and are using static FDB entries instead, when you turn bridge-learning on and delete those static entries, they are re-learned as expected in the bridge FDB table, however they are not installed into FRR and a log message is recorded in /var/log/frr/frr.log. |
3.7.5 |
| 2540873 |
On the EdgeCore AS7726 and AS7326 switches, physical links might stay operationally down (no-carrier) after a reboot. The problem is caused by a hardware initialization script that is not executed properly when the system boots up and is timing related. | 3.7.5 |
| 2540845 |
On the Dell Z9100-ON switch, smond reports various sensors going from OK to BAD or OK to ABSENT; then the sensors recover. |
3.7.1-3.7.5 |
| 2540827 |
The platform json file for the Dell S5048-ON switch is improperly populated. This creates an issue when trying to poll the inventory statistics with NetQ. | 3.7.3-3.7.5 |
| 2540798 |
The EdgeCore 7326-54X switch reports a platform hardware initialization error similar to the following:
The SFP28 module in the port might fail to initialize at startup. |
3.7.5 |
| 2540510 |
When traffic is routed by the VRR IP of an SVI, forward chain traffic is erroneously matched to input chain ACLs. | 3.7.3-3.7.5 |
| 2540486 |
Routes configured in the non-default VRF are not installed in hardware. Restarting switchd or rebooting the switch does not resolve the issue. This issue was discovered on the Helix4 switch but applies to all switches. In Cumulus Linux 3.7.5 and earlier, do not include the string eth in non-management interface names; routes associated with those interfaces might not be installed in hardware. |
3.7.3-3.7.5 |
| 2540288 |
The switchd service crashes when you add a route with a nexhop label. |
3.7.3-3.7.5 |
| 2540254 |
In an EVPN centralized routing deployment, the border leaf sends out incorrect packets when flapping the VLAN interface. | 3.7.2-3.7.5 |
| 2540247 |
On the Celestica SmallstoneXP switch, the QSFP links do not come up after you migrate to Cumulus Linux from a different network operating system and you see invalid SFF identifier errors similar to the following:
|
|
| 2540122 |
The snmpd daemon sometimes crashes with the error Unknown operation 6 in agentx_got_response. |
3.7.2-3.7.5 |
| 2540045 |
After adding or removing a VLAN from a VLAN-aware bridge or from a trunk either using the NCLU command or manually editing the /etc/network/interfaces file and running ifreload -a, an SVI bound to a different VLAN loses its IPv4 address defined in the /etc/network/interfaces file. |
3.7.3-3.7.5 |
| 2537415 |
FRR ignores a BGP password configured in a peer group that is associated with the bgp listen range. In the following example, the password cumulus has no effect on neighbors that connect in the 10.30.40.0/24 range. If the neighbor has neighbor password cumulus configured, the peering does not come up.
|
|
| 2536996 |
In a VXLAN/EVPN environment, when an unrelated interface either goes down or comes up, traffic traversing through the other underlay interface stops working for about two milliseconds. | |
| 2519945 |
In testing, it was determined that the MD5 password configured against a BGP listen-range peer-group (used to accept and create dynamic BGP neighbors) is not enforced (connections are accepted from peers that do not specify a password). |
3.7.5 Release Notes
Open Issues in 3.7.5
| Issue ID | Description | Affects | Fixed |
|---|---|---|---|
| 3410952 |
If MLAG is configured but disconnected from an MLAG peer for an extended period of time (days or more), there is a long delay (up to a minute per day) before traffic forwarding stabilizes after the MLAG peer connection re-establishes. | 3.7.0-4.3.1 | 4.3.2-4.4.5, 5.5.0-5.15.0 |
| 3376798 |
On Broadcom switches, Cumulus Linux does not create the hardware bridging domain for a traditional bridge with a VXLAN interface during switchd restart. The /var/log/switchd.log file includes the following exception logs shortly after switchd restarts:switchd[30158]: hal_bcm_l3.c:1617 find_egr_path_if_vxlan_overlay:vxlan overlay : nh PORT: port <#>, vlanMAC learning looks correct, but traffic does not flow as expected. |
3.7.0-4.3.1 | 4.3.2-4.4.5 |
| 3330705 |
When using TACACS+, a TACACS+ server name that returns more than one IP address, such as an IPv6 and IPv4 address, is counted many times against the limit of seven TACACS+ servers, which might cause some of the later listed servers to be ignored as over the limit. To work around this issue, you can set the prefer_ip_version configuration option (the default value is 4) to choose between an IPv4 or IPv6 address if both are present. |
3.7.0-5.3.1 | 5.4.0-5.15.0 |
| 3327477 |
If you use su to change to a user specified through TACACS+, the user becomes the local tacacs0 thru tacacs15 user instead of the named user to run sudo commands. As a result, the named user password might not match the local tacacs0 thru tacacs15 user password. |
3.7.0-3.7.16, 4.0.0-4.4.5, 5.0.0-5.15.0 | |
| 3216921 |
RADIUS authenticated users with read-only access to NCLU commands (users in the users_with_show list) can run edit commands if a username for a non-local account is on the users_with_edit line of the /etc/netd.conf file. To work around this issue, make sure that all usernames on the users_with_edit line of the /etc/netd.conf file are configured local users for the system (real Linux users) |
3.7.0-3.7.16, 4.3.0-4.4.5 | |
| 3209699 |
RADIUS authenticated users with read-only access to NCLU commands (users in the users_with_show list) can run edit commands if a username for a non-local account is on the users_with_edit line of the /etc/netd.conf file. To work around this issue, make sure that all usernames on the users_with_edit line of the /etc/netd.conf file are configured local users for the system (real Linux users) |
3.7.0-4.3.0, 4.4.0-5.2.1 | 4.3.1, 5.3.0-5.15.0 |
| 2552739 |
Counters for IPROUTER rules do not increase when traffic is forwarded to the CPU because there is no IP neighbor. | 3.7.2-3.7.16 | |
| 2551675 |
When you restart clagd, the edge port setting on the peer link changes. |
3.7.2-4.2.0 | 4.2.1-4.4.5 |
| 2550323 |
After a neighbor is removed, the redistributed neighbor entry is withdrawn from the BGP table, but the prefix might still be selected as the bestpath when the host’s originated prefix is not advertised. To work around this issue, recreate the neighbor entry and flap the interface to the host. Or, if the host is already down, manually create a neighbor entry with an invalid MAC address, which forces redistribute neighbor to re-withdraw the entry. |
3.7.3-3.7.16 | 4.0.0-4.4.5 |
| 2548382 |
The QuantaMesh BMS T3048-LY8 switch shows a low fan RPM in syslog. | 3.7.5-3.7.12, 4.0.0-4.1.1 | 3.7.13-3.7.16, 4.2.0-4.4.5 |
| 2548243 |
On switches with the Trident2+ ASIC, adding SPAN rules disables PBR rules. | 3.7.3-3.7.16, 4.0.0-4.4.5 | |
| 2547769 |
syslog might report a high load average with the CPU running a later microcode revision. |
3.7.4-3.7.12 | 3.7.13-3.7.16 |
| 2546998 |
When you configure Cumulus Linux with a /32 address on a switch port with a configured peer address (for example, to connect to a device using IP unnumbered), the switch sends GARPs for the peer address. | 3.7.5-3.7.11 | 3.7.12-3.7.16, 4.1.0-4.4.5 |
| 2546868 |
Broadcom Field Alert - SID - MMU 2B Errors A few of the MMU memories on Broadcom switches are grouped together with single parity control. During SER correction when a parity error occurs on one of those groups, other memory in that group might also report a SER error. This occurs when the memory is accessed either by a packet hit or through a schan operation. This issue can cause SER errors in other memory and cause traffic mis-forwarding or a packet drop. |
3.7.0-3.7.11, 4.0.0-4.0.1 | 3.7.12-3.7.16, 4.1.0-4.4.5 |
| 2546702 |
The FRR cl-support module times out on switches on the ARM platform even when the switch is not under heavy load. To work around this issue, run the cl-support -M command to disable timeouts. |
3.7.0-3.7.11, 4.0.0-4.0.1 | 3.7.12-3.7.16, 4.1.0-4.4.5 |
| 2545599 |
IPv6 table rules might affect forwarding. For example, if you create the following rule in the /etc/cumulus/acl/policy.d/03-sshd.rules file, the rule counter increments but IPv4 SSH traffic might be dropped.
|
3.7.2-3.7.11, 4.0.0-4.0.1 | 3.7.12-3.7.16, 4.1.0-4.4.5 |
| 2545235 |
On the Edgecore AS6812 switch, you might see rare I2C errors. | 3.7.2-3.7.10, 4.0.0-4.0.1 | 3.7.11-3.7.16, 4.1.0-4.4.5 |
| 2545132 |
On the Mellanox switch, ACL lookups are performed for VLAN matches when no rules with UNTAGGED match are present. |
3.7.2-3.7.10, 4.0.0-4.0.1 | 3.7.11-3.7.16, 4.1.0-4.4.5 |
| 2544385 |
The QCT QuantaMesh BMS T7032-IX7 switch may report “failed to request GPIO pin” errors during the boot up. | 3.7.5-3.7.10 | 3.7.11-3.7.16 |
| 2544311 |
Applying a policy-based routing (PBR) rule for all traffic from a host might disrupt ARP refresh for that connected host. | 3.7.5-3.7.16, 4.0.0-4.4.5 | |
| 2544212 |
Cumulus Linux poed generates excessive debug log entries. These will be reduced in a future release. | 3.7.3-3.7.10, 4.0.0-4.0.1 | 3.7.11-3.7.16, 4.1.0-4.4.5 |
| 2544155 |
NCLU requires you to specify an interface with multiple address-virtual statements in ascending MAC address order. |
3.7.5-3.7.16, 4.0.0-4.4.5 | |
| 2543727 |
ACL rules, such as the following, fail to install if you use swp+ (interfaces mentioned as wildcards).
You can now install such rules with swp+. |
3.7.3-3.7.16 | 4.0.0-4.4.5 |
| 2543211 |
In some cases, the switchd service might warn of excessive MAC moves from one switch port to itself (for example, from swp18 to swp18). |
3.7.0-3.7.16, 4.0.0-4.4.5 | |
| 2543113 |
NCLU restarts FRR when attempting to remove a BGP VRF stanza. This happens regardless of whether the VRF is valid/configured elsewhere on the switch or the removal is successful. To work around this issue, remove the stanza using vtysh. |
3.7.3-3.7.16 | 4.0.0-4.4.5 |
| 2543052 |
Received EVPN type-5 and type-2 MACIP routes are not installed in the kernel (and hardware) routing tables for the associated VRF, which causes traffic to be blackholed. The failure to install the default route causes complete reachability failure for the particular tenant on the affected racks. The routes that are not installed are seen as “inactive” in the routing subsystem (FRR) VRF routing table. This problem is rare and can occur only in EVPN configurations that have user-configured route targets (RTs) for tenant VRFs, and only following a restart of FRR. To work around this issue, either restart the FRR service on the affected switch with the sudo systemctl restart frr.service command or bounce the layer 3 SVI for the affected VRF; for example:
You can run the net show vrf vni command to print a mapping of VRF : L3-VNI : L3-SVI. |
3.7.5-3.7.16 | 4.0.0-4.4.5 |
| 2543044 |
Under certain conditions, EVPN next hops might not be removed when the contributing peer goes down or might not be populated when the BGP session to the contributing peer comes up. You can prevent EVPN next hops from not being removed when the contributing peer goes down by specifying static MAC addresses on all layer 3 VNIs. There is no workaround for preventing EVPN next hops from not being populated when the BGP session to the contributing peer comes up. |
3.7.2-3.7.16 | 4.0.0-4.4.5 |
| 2542871 |
After you issue the NCLU net del bgp vrf command and commit the change, Cumulus Linux does not remove the configuration from the /etc/frr/frr.conf file or the net show config commands. |
3.7.3-3.7.10, 4.0.0-4.0.1 | 3.7.11-3.7.16, 4.1.0-4.4.5 |
| 2542835 |
snmpd fails because NCLU does not remove agentaddress @vrf lines when running the net add snmp-server listening-address all command. |
3.7.4-3.7.16 | 4.0.0-4.4.5 |
| 2542823 |
On the Broadcom Trident 3 switch, VXLAN encapsulated packets are dropped on the ingress port (tagged layer 2 port) during transit forwarding (the local switch does not terminate the VXLAN tunnel). An example of where this two-layer VXLAN inside VXLAN encapsulation might occur: - VXLAN tunnel (#1) between two servers (different racks) to provide layer 2 extension for containers or VM hosts. - VXLAN tunnel (#2) between the TOR switch in rack 1 to the TOR switch located in the remote rack. To work around this issue, either: - Configure the edge port (facing the servers) to be an access port (instead of a trunk/tagged port) - Change the destination port from 4789 to something else (VXLAN tunnel terminated by the servers) |
3.7.5-3.7.11, 4.0.0-4.0.1 | 3.7.12-3.7.16, 4.1.0-4.4.5 |
| 2542726 |
After configuring switchd hal.bcm.per_vlan_router_mac_lookup to TRUE on a Broadcom switch, layer 2 traffic works over VXLAN but the host is not able to ping the locally connected gateway and loses routing ability to other IPs and subnets. |
3.7.5-3.7.8 | 3.7.9-3.7.16 |
| 2542336 |
On the Mellanox SN2410 switch, switchd does not start. |
3.7.2-3.7.8 | 3.7.9-3.7.16 |
| 2542309 |
When all ports are split into 4X on the EdgeCore AS7726 switch, switchd fails to start up and a crash is seen in syslog. |
3.7.5-3.7.6 | 3.7.7-3.7.16 |
| 2542301 |
When first creating a bond and enslaving an interface, NCLU hides some of the bridge command suggestions, although they are still accepted. |
3.7.3-3.7.16, 4.0.0-4.4.5 | |
| 2541791 |
In Cumulus Linux 3.7.6 and earlier, ifupdown2 does a string comparison to see if two addresses are the same. In Cumulus Linux 3.7.7, ifupdown2 does an integer comparison. For example, in Cumulus Linux 3.7.6 and earlier, hwaddress 00:00:5e:62:f8:02 and hwaddress 00:00:5e:62:f8:2 are not considered to be equal. In Cumulus Linux 3.7.7 and later, they are considered equal since 2 implies a leading zero. |
3.7.5-3.7.6 | 3.7.7-3.7.16 |
| 2541761 |
A TACACS privilege level 15 user mapped to tacacs15 cannot use net commands even though the user is part of the netedit and/or netshow user group. |
3.7.2-3.7.6 | 3.7.7-3.7.16 |
| 2541749 |
In a highly-scaled environment, while BGP is undergoing initial convergence, watchfrr times out and bgpd stops responding. |
3.7.5-3.7.6 | 3.7.7-3.7.16 |
| 2541645 |
Received EVPN type-5 routes are not installed into the kernel VRF routing table even though the route appears to be correct. The failure to install the default route makes the rack unreachable from the external world. | 3.7.5-3.7.16 | |
| 2541604 |
The snmpd service exits with a message similar to the following:
This problem might occur during or after network convergence events. For example, when bgpd needs to process a high number of updates and the CPU cannot keep up, bgpd is disconnected and agentx generates a core dump in snmpd due to a memory allocation problem. To work around this issue, disable agentx by commenting out the following lines in the /etc/snmp/snmpd.conf file. Then, restart the snmpd service with the systemctl restart snmpd command.
If you still want to poll the BGP4-MIB information, re-enable the bgp pass persist script by adding the following line in the /etc/snmp/snmpd.conf file:
|
3.7.2-3.7.8 | 3.7.9-3.7.16 |
| 2541494 |
Under certain circumstances (when you reboot or restart the switchd service), a race condition might occur which causes a synchronization issue resulting in hardware misprogramming of the VXLAN tunnel endpoint interface (VTEP). Packets destined out this tunnel are dropped in the egress direction. Packets arriving on this tunnel are dropped in the ingress direction. This is due to a race condition between ASIC and kernel programming that causes the kernel to incorrectly process the link state of a VXLAN interface. To work around this issue, you can bounce the layer 3 SVI for the affected VRF. For example:
Run the net show vrf vni command to show a mapping of the layer 3 VNI to layer 3 SVI for the VRF. Note: This workaround is not guaranteed because the race condition cannot be always be avoided. |
3.7.4-3.7.16 | |
| 2541362 |
If you configure bridge-learning off on a host-facing link in a VXLAN/EVPN environment and are using static FDB entries instead, when you turn bridge-learning on and delete those static entries, they are re-learned as expected in the bridge FDB table, however they are not installed into FRR and a log message is recorded in /var/log/frr/frr.log. |
3.7.5 | 3.7.6-3.7.16 |
| 2541294 |
In an EVPN configuration, the old MAC/IP route is present in the routing table after an IP mobility event. | 3.7.5-3.7.16 | |
| 2541213 |
On Trident2 switches, egress double-tagged frames incorrectly use 802.1Q outer ethertype instead of 802.1AD. | 3.7.5-3.7.6 | 3.7.7-3.7.16 |
| 2541212 |
The maximum-prefix configuration under the IPv4 address family has an optional restart value, which you can configure. This configuration is ignored and, instead of restarting the sessions every x minutes, the peer constantly changes between established and idle due to the prefix count being exceeded. |
3.7.5-3.7.16, 4.0.0-4.4.5 | |
| 2541095 |
The RADIUS AAA client does the source IP address bind first, then the setsockopt VRF, which causes a failure due to a kernel check for an address mismatch with the VRF. |
3.7.4-3.7.6 | 3.7.7-3.7.16 |
| 2541090 |
The dhcrelay service crashes when the DHCP relay packet comes back from the server. To work around this issue, remove the –nl flag from the dhcrelay service. |
3.7.3-3.7.6 | 3.7.7-3.7.16 |
| 2541029 |
On switches with the Trident2 ASIC, 802.1Q-encapsulated control plane traffic received on an interface with 802.1AD configured subinterfaces might be dropped. This issue only affects QinQ configurations. |
3.7.5-3.7.16, 4.0.0-4.4.5 | |
| 2540980 |
After upgrading the BIOS to 3.21.0.0-6, when you run the reboot, shutdown or init commands with certain options, the switch powers off. To determine the BIOS version of the switch, run:
|
3.7.5-3.7.6 | 3.7.7-3.7.16 |
| 2540950 |
On the QuantaMesh T4048-IX8 or EdgeCore AS7326-56X switch, when using a 1000BASE-T SFP module, the module LEDs do not light to reflect link status. |
3.7.3-4.1.1 | 4.2.0-4.4.5 |
| 2540873 |
On the EdgeCore AS7726 and AS7326 switches, physical links might stay operationally down (no-carrier) after a reboot. The problem is caused by a hardware initialization script that is not executed properly when the system boots up and is timing related. | 3.7.5 | 3.7.6-3.7.16 |
| 2540863 |
On the EdgeCore AS5812-54X switch, the PSU2 Fan1 fluctuates between OK and LOW. When the fan speed is reported as LOW, the RPM is shown as a negative number. |
3.7.3-3.7.16 | |
| 2540845 |
On the Dell Z9100-ON switch, smond reports various sensors going from OK to BAD or OK to ABSENT; then the sensors recover. |
3.7.1-3.7.5 | 3.7.6-3.7.16 |
| 2540843 |
On the Dell S3048 switch, ports with FEC disabled show as BaseR on boot up. | 3.7.3-3.7.6 | 3.7.7-3.7.16 |
| 2540830 |
On the Dell S5248F switch, packets forwarded to the CPU are corrupted. | 3.7.3-3.7.16 | |
| 2540827 |
The platform json file for the Dell S5048-ON switch is improperly populated. This creates an issue when trying to poll the inventory statistics with NetQ. | 3.7.3-3.7.5 | 3.7.6-3.7.16 |
| 2540823 |
On the EdgeCore 7326-54X switch, switchd does not start on initial install because the decode-syseeprom command fails. However in ONIE, onie-syseeprom has no issues. |
3.7.5-3.7.6 | 3.7.7-3.7.16 |
| 2540798 |
The EdgeCore 7326-54X switch reports a platform hardware initialization error similar to the following:
The SFP28 module in the port might fail to initialize at startup. |
3.7.5 | 3.7.6-3.7.16 |
| 2540753 |
If the interface alias contains a single or double quotation mark, or an apostrophe, the net show configuration commands fail with the following error:
|
3.7.5-3.7.16, 4.0.0-4.4.5 | |
| 2540737 |
When you commit a configuration change to a VXLAN layer 2 VNI in an MLAG configuration, the peer link on the MLAG secondary switch goes into an STP blocking state. | 3.7.2-3.7.6 | 3.7.7-3.7.16 |
| 2540721 |
If you modify BFD timers in the /etc/frr/frr.conf file, then run the systemctl reload frr command, the neighbor connections flap. |
3.7.4-3.7.6 | 3.7.7-3.7.16 |
| 2540684 |
On a Dell S5248F (Trident3) switch, packets from switch ports are forwarded to the CPU and are sometimes corrupted. The corruption might result in BGP peerings being down, which can lead to all VXLAN traffic to and from a node to be lost, causing an outage to dually connected hosts in a rack. To work around this issue, restart switchd. |
3.7.3-3.7.8 | 3.7.9-3.7.16, 4.0.0-4.4.5 |
| 2540600 |
If the clagd-vxlan-anycast-ip is removed from the /etc/network/interfaces file (either with the NCLU command or by editing the file manually), MLAG still believes it is present until clagd restarts. |
3.7.3-3.7.8 | 3.7.9-3.7.16, 4.0.0-4.4.5 |
| 2540557 |
On Trident3 switches, transit packets larger than 1500 bytes(DF) routed between SVIs is unexpectedly forwarded to the CPU even when the MTU is greater than 9000. This severely limits throughput for routed jumbo frames as packets arriving at a high interval are dropped to the CPU. | 3.7.0-3.7.16 | |
| 2540510 |
When traffic is routed by the VRR IP of an SVI, forward chain traffic is erroneously matched to input chain ACLs. | 3.7.3-3.7.5 | 3.7.6-3.7.16 |
| 2540486 |
Routes configured in the non-default VRF are not installed in hardware. Restarting switchd or rebooting the switch does not resolve the issue. This issue was discovered on the Helix4 switch but applies to all switches. In Cumulus Linux 3.7.5 and earlier, do not include the string eth in non-management interface names; routes associated with those interfaces might not be installed in hardware. |
3.7.3-3.7.5 | 3.7.6-3.7.16 |
| 2540464 |
If you have dynamic route leaking configured between any two VRFs and the BGP instance for the default VRF is not defined, removing an import vrf statement crashes bgpd. This occurs even if neither of the leaking VRFs are the default VRF. |
3.7.4-3.7.6 | 3.7.7-3.7.16 |
| 2540444 |
SNMP incorrectly requires engine ID specification. |
3.7.4-3.7.16, 4.0.0-4.4.5 | |
| 2540352 |
When you use NCLU to configure a route map, the parser allows for glob matching of interfaces for a match interface condition when there can only be a single interface matched. The proper syntax is to use multiple route map clauses, each matching a single interface, instead of a single clause matching multiple interfaces. For example, this command is incorrect:
These commands are correct:
|
3.7.2-3.7.16, 4.0.0-4.4.5 | |
| 2540340 |
NCLU allows for the configuration of addresses on VRF interfaces, but tab completion for the net add vrf command just displays
Tab completion for the net add vrf command works correctly. |
3.7.4-3.7.16, 4.0.0-4.4.5 | |
| 2540288 |
The switchd service crashes when you add a route with a nexhop label. |
3.7.3-3.7.5 | 3.7.6-3.7.16 |
| 2540274 |
On the Maverick switch, CPU forwarded packets might be dropped when there is no route to a leaked host route. | 3.7.5-3.7.16, 4.0.0-4.4.5 | |
| 2540268 |
An incorrect readout of the optical transceiver high temperature alarm threshold (read as 17 degrees centigrade), disables a 100G optical module on Mellanox Spectrum switches. | 3.7.2-3.7.6 | 3.7.7-3.7.16 |
| 2540254 |
In an EVPN centralized routing deployment, the border leaf sends out incorrect packets when flapping the VLAN interface. | 3.7.2-3.7.5 | 3.7.6-3.7.16 |
| 2540204 |
When links come up after FRR is started, VRF connected routes do not get redistributed. | 3.7.4-3.7.16, 4.0.0-4.4.5 | |
| 2540192 |
The net del bridge bridge mcsnoop yes command does not return the value to the default of disabled. To work around this issue, use the net add bridge bridge mcsnoop no command to delete the mcsnoop attribute and return to the default value. |
3.7.4-3.7.16, 4.0.0-4.4.5 | |
| 2540155 |
On the Broadcom switch, when moving configuration from bridged to routed (or toggling from routed to bridged to routed), some traffic is not seen by the kernel. This can cause BGP to not establish on a transit node. |
3.7.3-3.7.16, 4.0.0-4.4.5 | |
| 2540122 |
The snmpd daemon sometimes crashes with the error Unknown operation 6 in agentx_got_response. |
3.7.2-3.7.5 | 3.7.6-3.7.16 |
| 2540045 |
After adding or removing a VLAN from a VLAN-aware bridge or from a trunk either using the NCLU command or manually editing the /etc/network/interfaces file and running ifreload -a, an SVI bound to a different VLAN loses its IPv4 address defined in the /etc/network/interfaces file. |
3.7.3-3.7.5 | 3.7.6-3.7.16 |
| 2540042 |
When you try to configure the VRRP priority and advertisement-interval with NCLU on a traditional mode bridge, the net commit command fails. To work around this issue, use the vtysh command (inside FRR) to change the VRRP priority or advertisement-interval on traditional bridges. For example:
|
3.7.4-3.7.16, 4.0.0-4.4.5 | |
| 2540041 |
On SVIs in a VLAN-aware bridge, you cannot change the VRRP priority with NCLU. To work around this issue, run the vtysh command inside FRR to change the default priority. For example:
|
3.7.4-3.7.16, 4.0.0-4.4.5 | |
| 2540040 |
Cumulus Linux uses VRRPv3 as the default version, and enables both preempt and accept mode by default. You cannot change these default values with NCLU. To work around this issue, run the vtysh commands (inside FRR) to change the default values. For example:
|
3.7.4-3.7.16, 4.0.0-4.4.5 | |
| 2540031 |
NCLU does not honor auto all in the /etc/network/interfaces file and removes the existing configuration if no individual auto lines exist. |
3.7.3-3.7.16, 4.0.0-4.4.5 | |
| 2540017 |
The net commit command fails when you try to add a static voice VLAN or delete dot1x configuration for an interface when the port is already authorized. |
3.7.4-3.7.6 | 3.7.7-3.7.16 |
| 2539994 |
When you try to remove a BGP peer group configuration with NCLU, the command fails but no warning message is shown. For example:
|
3.7.2-3.7.16, 4.0.0-4.4.5 | |
| 2539962 |
When an LDAP user that does not have NCLU privileges (either in the netshow or netedit group, or in the /etc/netd.conf file) runs an NCLU command, a traceback occurs instead of a permissions error. |
3.7.0-3.7.16, 4.0.0-4.4.5 | |
| 2539928 |
When you delete or add 802.1X configuration on a port in a traditional mode bridge, all the ports are removed from the bridge. | 3.7.4-3.7.6 | 3.7.7-3.7.16 |
| 2539686 |
The Cumulus Linux switch sometimes sends out ARP request packets with the sender IP address set to 0.0.0.0. | 3.7.2-3.7.6 | 3.7.7-3.7.16 |
| 2539670 |
On the Edgecore 4610-54P switch, automatic medium-dependent interface crossover (auto-MDIX) stops working on a 100M full duplex interface and does not detect the required cable connection type. |
3.7.2-3.7.16, 4.0.0-4.4.5 | |
| 2539433 |
If multiple files reference the same module, ifupdown2 user-defined policy overrides do not apply. | 3.7.0-3.7.6 | 3.7.7-3.7.16 |
| 2539422 |
In FRR, you can remove the default BGP instance even if there are other instances that depend on it, which causes configuration issues. | 3.7.3-3.7.6 | 3.7.7-3.7.16 |
| 2539218 |
On the Mellanox SN2700 switch, the 100G-LR4 port might have problems establishing a link over a long distance (around 500 miles) through a telco service provider after a flap. If the laser is forced up by the link provider’s equipment, the circuit comes up. However, the circuit cannot survive a flap and the link remains down after a flap event. However, you might have to explicitly disable auto-negotiation and FEC in this scenario. | 3.7.2-3.7.6 | 3.7.7-3.7.16 |
| 2539169 |
On the QuantaMesh T1048-LY4R, smonctl reports that all power supplies are absent:
|
3.7.3-3.7.6 | 3.7.7-3.7.16 |
| 2539124 |
The net add interface command adds no ptm-enable for that interface in the frr.conf file. Running the net add or the net del command does not remove no ptm-enable from the frr.conf file. You have to remove it manually using vtysh. |
3.7.2-3.7.16, 4.0.0-4.4.5 | |
| 2539081 |
When you delete post-up and pre-down IP peer entries from the etc/network/interfaces file, then run the ifreload command, the IP addresses are not removed and the route remains in the route table. To work around this issue, either delete the IP addresses without the /32 mask component or flush the IP addresses for the interface with the ip addr flush dev command. |
3.7.0-3.7.16 | 4.0.0-4.4.5 |
| 2538980 |
A dummy interface does not inherit the MTU from a defaults file in /etc/network/ifupdown2/policy.d. A dummy interface is typically used to keep SVI interfaces up when there are no switch ports up that are associated with that VLAN. |
3.7.2-3.7.6 | 3.7.7-3.7.16 |
| 2538910 |
In a layer 2 VXLAN configuration, where each ECMP path is a layer 3 LACP bond with multiple port members, ECMP hash appears fine for data traffic over VXLAN from one VTEP to another, but the LACP hash is unbalanced. | 3.7.1-3.7.6 | 3.7.7-3.7.16 |
| 2538875 |
IPv6 multicast traffic destined to an unregistered multicast group is flooded to all ports in a bridge despite the bridge.optimized_mcast_flood = TRUE setting in the /etc/cumulus/swichd.conf file. |
3.7.2-3.7.16 | |
| 2538790 |
NCLU automatically adds the VLAN ID (for the layer 3 VNI/SVI) to the bridge when you run net add vxlan . This configuration breaks network connectivity in an EVPN symmetric routing configuration using MLAG. To restore connectivity, remove the VLAN ID from the bridge. |
3.7.2-3.7.16, 4.0.0-4.4.5 | |
| 2538756 |
When you flap a VNI with ifdown vni and ifup vni, the value of all MTUs for the SVI lowers to 1500 regardless of the default value set in the /etc/network/ifupdown2/policy.d/mtu.json file. This behavior does not occur if you flap the link with ip link set vni down. |
3.7.2-3.7.6 | 3.7.7-3.7.16 |
| 2538741 |
The NCLU command net show bridge spanning-tree does not show the MLAG peer link as part of the STP forwarding instance.To work around this issue, use the mstpctl command to confirm the STP status of the port. |
3.7.2-3.7.8 | 3.7.9-3.7.16 |
| 2538590 |
When you configure a control plane ACL to define permit and deny rules destined to the local switch, NCLU programs the control plane ACL rules into the FORWARD chain. |
3.7.2-3.7.16, 4.0.0-4.4.5 | |
| 2538562 |
On an RMP/1G-T switch, when you remove link-speed 100 with the NCLU command or by editing the etc/network/interfaces file to revert the 100M interface to the default (1G auto), the interface fails to recover and does not come back up.After you remove the link-speed, ethtool shows the advertised link modes as not reported and Speed/Duplex as unknown.To work around this issue and bring the interface back up, either restart switchd or use ethtool to configure the speed, advertised, duplex or MDI-X settings. Note: The advertised link mode gets set incorrectly if you include 1000baseT/Half. The port will come up successfully at 1G. |
3.7.2-3.7.16, 4.0.0-4.4.5 | |
| 2538480 |
Modifying the /etc/netd.conf file to set show_linux_command = True does not take effect. |
3.7.2-3.7.8 | 3.7.9-3.7.16 |
| 2538302 |
portwd allows an error to change the module type based on the error. For example, a bad write to a module might cause the module type to flap, which causes the link itself to flap. |
3.7.0-3.7.16 | |
| 2538294 |
If you use NCLU to create an iBGP peering across the peer link, running the net add bgp l2vpn evpn neighbor peerlink.4094 activate command creates a new eBGP neighborship when one has already been configured for iBGP. This is unexpected; the existing iBGP configuration is valid. |
3.7.0-3.7.16, 4.0.0-4.4.5 | |
| 2538256 |
On the Broadcom switch, when a link-local multicast frame is received on an access port with a VNI in the bridge, two copies of the packet are sent across the VNI to remote VTEPs and the receiving hosts observe duplicate packets. |
3.7.2-4.0.1 | 4.1.0-4.4.5 |
| 2538022 |
When you remove an interface from a bridge and add it to a VRF in the same commit/ifreload, the IPv6 link-local address is not created automatically. To work around this issue, do the change in two separate commits. First, remove the interface from the bridge, which causes it to be a layer 2 interface. Then, enslave the interface to the VRF. |
3.7.2-3.7.8 | 3.7.9-3.7.16 |
| 2537819 |
When you enable FEC (RS or BaseR) on an interface, removing the configuration from that interface does not revert the FEC status to off/none. |
3.7.2-3.7.16 | 4.0.0-4.4.5 |
| 2537806 |
Bridging ISIS traffic fails because layer 2 cache rules forward ISIS traffic to the CPU, where it is then dropped. To work around this issue, contact Customer Support. |
3.7.2-3.7.6 | 3.7.7-3.7.16 |
| 2537699 |
There is a limitation on the number of SVI interfaces you can specify as DHCP relay interfaces in the /etc/default/isc-dhcp-relay file. For example, 1500 SVI interfaces causes the dhcrelay service to exit without a core file and logs similar to the following are generated for the interfaces:
Eventually the dhcrelay service stops. |
3.7.1-3.7.16, 4.0.0-4.4.5 | |
| 2537544 |
When you run the mstpctl command, you might see the bridge-port state as blocking when it is actually disabled. You might see the same incorrect bridge-port state when other programs or tools use the output of mstpctl; for example, SNMP output from the BRIDGE-MIB. |
3.7.1-3.7.16, 4.0.0-4.4.5 | |
| 2537536 |
When FRR restarts, snmp[err] dev/kmem: Permission denied error messages are recorded in the log file and SNMPd might crash periodically. |
3.7.5-3.7.16 | 4.0.0-4.4.5 |
| 2537378 |
NCLU SNMPv3 user configuration (add, delete, modify) does not complete. Changes are made to the /etc/snmp/snmpd.conf file but the SNMPv3 user cache file /var/lib/snmp/snmpd.conf fails to update correctly and the configuration does not reflect in operation. To work around this issue, stop snmpd, remove the cache file, then restart snmpd. |
3.7.1-3.7.16 | |
| 2537188 |
When an event in the network, such as a switchd or networking service restart, leads to an OVSDB server high availability transition, an ovs-vtepd core might occur. This core generation has no effect on the functionality of high availability when the active OVSDB server is back in the network. |
3.7.2-3.7.16 | |
| 2537153 |
In rare cases, certain IPv6 BGP peers fail to reestablish after switchd restarts. |
3.7.2-3.7.8 | 3.7.9-3.7.16 |
| 2537104 |
When you try to stop hsflowd on the Trident II+ switch with the systemctl stop hsflowd command, the process hangs until you stop it with SIGKILL. |
3.7.1-3.7.16 | 4.0.0-4.4.5 |
| 2537061 |
The Dell S5048F-ON switch (with reverse airflow, rear to front), shows the Temp-3 sensor as absent. |
3.7.1-4.0.1 | 4.1.0-4.4.5 |
| 2536650 |
Mellanox Spectrum and Helix4 switches occasionally send malformed packets and do not send any flow samples (only counters). While this issue is fixed for switches with the Spectrum ASIC, this is a [known limitation|https://docs.cumulusnetworks.com/cumulus-linux/Monitoring-and-Troubleshooting/Network-Troubleshooting/Monitoring-System-Statistics-and-Network-Traffic-with-sFlow/#caveats-and-errata] on this Helix4 platform. |
3.7.0-3.7.8 | 3.7.9-3.7.16, 4.0.0-4.4.5 |
| 2536639 |
On a Dell S4048 switch, when you set the eth0 speed to 100, either with NCLU or by editing the /etc/network/interfaces file, the igb driver crashes, which brings down eth0. To work around this issue: * If eth0 is configured in the management VRF, power cycle the switch; the eth0 configuration fails and reverts back to the default (auto-negotiation/1000). * If eth0 is configured in the default VRF and you power cycle after the crash, igb continues to crash on boot up (before getting to login prompt); power-cycle the switch, select the Advanced option in GRUB to boot to recovery mode, then modify the /etc/network/interfaces file. |
3.7.0-3.7.16 | 4.0.0-4.4.5 |
| 2536608 |
Single tagged ARP requests received on a QinQ-over-VXLAN access port are dropped if ARP suppression is enabled on an unrelated VNI. |
3.7.0-3.7.16 | |
| 2536559 |
When deleting an interface using NCLU, if the /etc/network/interfaces alias is different than the /etc/frr/frr.conf description, the net commit command returns the following error:
Despite this error, the change is made and the description is removed from the frr.conf file. |
3.7.3-3.7.10 | 3.7.11-3.7.16 |
| 2536384 |
The BFD packet redirection logic used by OVSDB server high availability mode redirects BUM packets across the peer link. The iptables rule for redirection does differentiate between BFD and non-BFD VXLAN inner packets because the service node sends all frames with its own IP address as the tunnel source IP address. The VXLAN encapsulated BUM packets do not get forwarded to the CPU and do not go through the iptable redirection rule; only VXLAN encapsulated BFD packets get forwarded to the CPU due to the inner MAC DA lookup in hardware. |
3.7.0-3.7.16, 4.0.0-4.4.5 | |
| 2536266 |
When a VXLAN SVI transitions to a non-VXLAN SVI, the associated VRRP MAC addresses are not removed. After the transition happens, the removal fails as the VXLAN context is lost and you see the following switchd error:
|
3.7.5-3.7.6 | 3.7.7-3.7.16 |
| 2536230 |
On the Broadcom switch with the Trident3 ASIC, the ECN-CE bit is set by default on transit traffic. This might result in hosts adjusting traffic behavior if they are configured for the ECN feature. In Cumulus Linux 3.7.11, the default behavior changed; the ECN-CE bit is no longer set by default on transit traffic. |
3.7.3-3.7.10, 4.0.0-4.0.1 | 3.7.11-3.7.16, 4.1.0-4.4.5 |
| 2536179 |
On switches with the Trident 2+ ASIC, counters associated with VLANs and VRFs are not working. | 3.7.0-3.7.16, 4.0.0-4.4.5 | |
| 2535986 |
At a high CPU transmit traffic rate (for example, if there is unexpected CPU generated flooding or replication in software), when the ASIC packet driver cannot keep up with the transmit rate because there are no free DMA buffers, it can back pressure by suspending the switch port transmit queues. This can fill up the application socket buffers resulting in No buffer space available error messages on protocol sockets.When the driver recovers, it automatically resumes the transmit queues. In most cases these error messages are transient. In rare cases, the hardware queues might get stuck, which you can recover with a switchd restart. |
3.7.0-3.7.16, 4.0.0-4.4.5 | |
| 2535965 |
On the Trident3 switch, static PIM with IIF based on a layer 2 bridge does not work reliably. PIM Join via signaling is required for IPMC to work properly. To work around this issue, use dynamic signaling (joins) to manage IP multicast traffic. |
3.7.0-3.7.16, 4.0.0-4.4.5 | |
| 2535209 |
The net show lldp command sometimes shows the port description in the Remote Port field. The net show interface command shows the correct value in the Remote Host field.To work around this issue, use net show interface command for LLDP output when connected to Cisco equipment. |
3.7.5-3.7.10, 4.0.0-4.4.5 | 3.7.11-3.7.16 |
| 2534450 |
The default BGP instance must be provisioned and always exist for proper operation of dynamic leaking of routes between VRFs. | 3.7.0-3.7.16 | 4.0.0-4.4.5 |
| 2532924 |
The NetQ agent is bundled with Cumulus VX 3.4.3 and later; however, the NetQ agent is not bundled with Cumulus Linux 3.4.3 and later. The NetQ agent has been removed from Cumulus VX 3.7.7. The NetQ agent will be bundled with Cumulus Linux in a future release. | 3.7.0-3.7.6 | 3.7.7-3.7.16 |
Fixed Issues in 3.7.5
| Issue ID | Description | Affects |
|---|---|---|
| 2540520 |
When IGMP snooping is enabled on a Broadcom switch, after multiple PIM join and leave messages are sent, switchd crashes and reports log messages similar to the following:
|
3.7.4 |
| 2540496 |
Tomahawk or Tomahawk+ switches drop traffic when using EVPN centralized routing. | 3.7.4 |
3.7.4 Release Notes
Open Issues in 3.7.4
| Issue ID | Description | Affects | Fixed |
|---|---|---|---|
| 3410952 |
If MLAG is configured but disconnected from an MLAG peer for an extended period of time (days or more), there is a long delay (up to a minute per day) before traffic forwarding stabilizes after the MLAG peer connection re-establishes. | 3.7.0-4.3.1 | 4.3.2-4.4.5, 5.5.0-5.15.0 |
| 3376798 |
On Broadcom switches, Cumulus Linux does not create the hardware bridging domain for a traditional bridge with a VXLAN interface during switchd restart. The /var/log/switchd.log file includes the following exception logs shortly after switchd restarts:switchd[30158]: hal_bcm_l3.c:1617 find_egr_path_if_vxlan_overlay:vxlan overlay : nh PORT: port <#>, vlanMAC learning looks correct, but traffic does not flow as expected. |
3.7.0-4.3.1 | 4.3.2-4.4.5 |
| 3330705 |
When using TACACS+, a TACACS+ server name that returns more than one IP address, such as an IPv6 and IPv4 address, is counted many times against the limit of seven TACACS+ servers, which might cause some of the later listed servers to be ignored as over the limit. To work around this issue, you can set the prefer_ip_version configuration option (the default value is 4) to choose between an IPv4 or IPv6 address if both are present. |
3.7.0-5.3.1 | 5.4.0-5.15.0 |
| 3327477 |
If you use su to change to a user specified through TACACS+, the user becomes the local tacacs0 thru tacacs15 user instead of the named user to run sudo commands. As a result, the named user password might not match the local tacacs0 thru tacacs15 user password. |
3.7.0-3.7.16, 4.0.0-4.4.5, 5.0.0-5.15.0 | |
| 3216921 |
RADIUS authenticated users with read-only access to NCLU commands (users in the users_with_show list) can run edit commands if a username for a non-local account is on the users_with_edit line of the /etc/netd.conf file. To work around this issue, make sure that all usernames on the users_with_edit line of the /etc/netd.conf file are configured local users for the system (real Linux users) |
3.7.0-3.7.16, 4.3.0-4.4.5 | |
| 3209699 |
RADIUS authenticated users with read-only access to NCLU commands (users in the users_with_show list) can run edit commands if a username for a non-local account is on the users_with_edit line of the /etc/netd.conf file. To work around this issue, make sure that all usernames on the users_with_edit line of the /etc/netd.conf file are configured local users for the system (real Linux users) |
3.7.0-4.3.0, 4.4.0-5.2.1 | 4.3.1, 5.3.0-5.15.0 |
| 2552739 |
Counters for IPROUTER rules do not increase when traffic is forwarded to the CPU because there is no IP neighbor. | 3.7.2-3.7.16 | |
| 2551675 |
When you restart clagd, the edge port setting on the peer link changes. |
3.7.2-4.2.0 | 4.2.1-4.4.5 |
| 2550323 |
After a neighbor is removed, the redistributed neighbor entry is withdrawn from the BGP table, but the prefix might still be selected as the bestpath when the host’s originated prefix is not advertised. To work around this issue, recreate the neighbor entry and flap the interface to the host. Or, if the host is already down, manually create a neighbor entry with an invalid MAC address, which forces redistribute neighbor to re-withdraw the entry. |
3.7.3-3.7.16 | 4.0.0-4.4.5 |
| 2548243 |
On switches with the Trident2+ ASIC, adding SPAN rules disables PBR rules. | 3.7.3-3.7.16, 4.0.0-4.4.5 | |
| 2547769 |
syslog might report a high load average with the CPU running a later microcode revision. |
3.7.4-3.7.12 | 3.7.13-3.7.16 |
| 2546868 |
Broadcom Field Alert - SID - MMU 2B Errors A few of the MMU memories on Broadcom switches are grouped together with single parity control. During SER correction when a parity error occurs on one of those groups, other memory in that group might also report a SER error. This occurs when the memory is accessed either by a packet hit or through a schan operation. This issue can cause SER errors in other memory and cause traffic mis-forwarding or a packet drop. |
3.7.0-3.7.11, 4.0.0-4.0.1 | 3.7.12-3.7.16, 4.1.0-4.4.5 |
| 2546702 |
The FRR cl-support module times out on switches on the ARM platform even when the switch is not under heavy load. To work around this issue, run the cl-support -M command to disable timeouts. |
3.7.0-3.7.11, 4.0.0-4.0.1 | 3.7.12-3.7.16, 4.1.0-4.4.5 |
| 2545599 |
IPv6 table rules might affect forwarding. For example, if you create the following rule in the /etc/cumulus/acl/policy.d/03-sshd.rules file, the rule counter increments but IPv4 SSH traffic might be dropped.
|
3.7.2-3.7.11, 4.0.0-4.0.1 | 3.7.12-3.7.16, 4.1.0-4.4.5 |
| 2545235 |
On the Edgecore AS6812 switch, you might see rare I2C errors. | 3.7.2-3.7.10, 4.0.0-4.0.1 | 3.7.11-3.7.16, 4.1.0-4.4.5 |
| 2545132 |
On the Mellanox switch, ACL lookups are performed for VLAN matches when no rules with UNTAGGED match are present. |
3.7.2-3.7.10, 4.0.0-4.0.1 | 3.7.11-3.7.16, 4.1.0-4.4.5 |
| 2544212 |
Cumulus Linux poed generates excessive debug log entries. These will be reduced in a future release. | 3.7.3-3.7.10, 4.0.0-4.0.1 | 3.7.11-3.7.16, 4.1.0-4.4.5 |
| 2543727 |
ACL rules, such as the following, fail to install if you use swp+ (interfaces mentioned as wildcards).
You can now install such rules with swp+. |
3.7.3-3.7.16 | 4.0.0-4.4.5 |
| 2543211 |
In some cases, the switchd service might warn of excessive MAC moves from one switch port to itself (for example, from swp18 to swp18). |
3.7.0-3.7.16, 4.0.0-4.4.5 | |
| 2543113 |
NCLU restarts FRR when attempting to remove a BGP VRF stanza. This happens regardless of whether the VRF is valid/configured elsewhere on the switch or the removal is successful. To work around this issue, remove the stanza using vtysh. |
3.7.3-3.7.16 | 4.0.0-4.4.5 |
| 2543044 |
Under certain conditions, EVPN next hops might not be removed when the contributing peer goes down or might not be populated when the BGP session to the contributing peer comes up. You can prevent EVPN next hops from not being removed when the contributing peer goes down by specifying static MAC addresses on all layer 3 VNIs. There is no workaround for preventing EVPN next hops from not being populated when the BGP session to the contributing peer comes up. |
3.7.2-3.7.16 | 4.0.0-4.4.5 |
| 2542871 |
After you issue the NCLU net del bgp vrf command and commit the change, Cumulus Linux does not remove the configuration from the /etc/frr/frr.conf file or the net show config commands. |
3.7.3-3.7.10, 4.0.0-4.0.1 | 3.7.11-3.7.16, 4.1.0-4.4.5 |
| 2542835 |
snmpd fails because NCLU does not remove agentaddress @vrf lines when running the net add snmp-server listening-address all command. |
3.7.4-3.7.16 | 4.0.0-4.4.5 |
| 2542336 |
On the Mellanox SN2410 switch, switchd does not start. |
3.7.2-3.7.8 | 3.7.9-3.7.16 |
| 2542301 |
When first creating a bond and enslaving an interface, NCLU hides some of the bridge command suggestions, although they are still accepted. |
3.7.3-3.7.16, 4.0.0-4.4.5 | |
| 2541761 |
A TACACS privilege level 15 user mapped to tacacs15 cannot use net commands even though the user is part of the netedit and/or netshow user group. |
3.7.2-3.7.6 | 3.7.7-3.7.16 |
| 2541604 |
The snmpd service exits with a message similar to the following:
This problem might occur during or after network convergence events. For example, when bgpd needs to process a high number of updates and the CPU cannot keep up, bgpd is disconnected and agentx generates a core dump in snmpd due to a memory allocation problem. To work around this issue, disable agentx by commenting out the following lines in the /etc/snmp/snmpd.conf file. Then, restart the snmpd service with the systemctl restart snmpd command.
If you still want to poll the BGP4-MIB information, re-enable the bgp pass persist script by adding the following line in the /etc/snmp/snmpd.conf file:
|
3.7.2-3.7.8 | 3.7.9-3.7.16 |
| 2541494 |
Under certain circumstances (when you reboot or restart the switchd service), a race condition might occur which causes a synchronization issue resulting in hardware misprogramming of the VXLAN tunnel endpoint interface (VTEP). Packets destined out this tunnel are dropped in the egress direction. Packets arriving on this tunnel are dropped in the ingress direction. This is due to a race condition between ASIC and kernel programming that causes the kernel to incorrectly process the link state of a VXLAN interface. To work around this issue, you can bounce the layer 3 SVI for the affected VRF. For example:
Run the net show vrf vni command to show a mapping of the layer 3 VNI to layer 3 SVI for the VRF. Note: This workaround is not guaranteed because the race condition cannot be always be avoided. |
3.7.4-3.7.16 | |
| 2541095 |
The RADIUS AAA client does the source IP address bind first, then the setsockopt VRF, which causes a failure due to a kernel check for an address mismatch with the VRF. |
3.7.4-3.7.6 | 3.7.7-3.7.16 |
| 2541090 |
The dhcrelay service crashes when the DHCP relay packet comes back from the server. To work around this issue, remove the –nl flag from the dhcrelay service. |
3.7.3-3.7.6 | 3.7.7-3.7.16 |
| 2540950 |
On the QuantaMesh T4048-IX8 or EdgeCore AS7326-56X switch, when using a 1000BASE-T SFP module, the module LEDs do not light to reflect link status. |
3.7.3-4.1.1 | 4.2.0-4.4.5 |
| 2540863 |
On the EdgeCore AS5812-54X switch, the PSU2 Fan1 fluctuates between OK and LOW. When the fan speed is reported as LOW, the RPM is shown as a negative number. |
3.7.3-3.7.16 | |
| 2540845 |
On the Dell Z9100-ON switch, smond reports various sensors going from OK to BAD or OK to ABSENT; then the sensors recover. |
3.7.1-3.7.5 | 3.7.6-3.7.16 |
| 2540843 |
On the Dell S3048 switch, ports with FEC disabled show as BaseR on boot up. | 3.7.3-3.7.6 | 3.7.7-3.7.16 |
| 2540830 |
On the Dell S5248F switch, packets forwarded to the CPU are corrupted. | 3.7.3-3.7.16 | |
| 2540827 |
The platform json file for the Dell S5048-ON switch is improperly populated. This creates an issue when trying to poll the inventory statistics with NetQ. | 3.7.3-3.7.5 | 3.7.6-3.7.16 |
| 2540737 |
When you commit a configuration change to a VXLAN layer 2 VNI in an MLAG configuration, the peer link on the MLAG secondary switch goes into an STP blocking state. | 3.7.2-3.7.6 | 3.7.7-3.7.16 |
| 2540721 |
If you modify BFD timers in the /etc/frr/frr.conf file, then run the systemctl reload frr command, the neighbor connections flap. |
3.7.4-3.7.6 | 3.7.7-3.7.16 |
| 2540684 |
On a Dell S5248F (Trident3) switch, packets from switch ports are forwarded to the CPU and are sometimes corrupted. The corruption might result in BGP peerings being down, which can lead to all VXLAN traffic to and from a node to be lost, causing an outage to dually connected hosts in a rack. To work around this issue, restart switchd. |
3.7.3-3.7.8 | 3.7.9-3.7.16, 4.0.0-4.4.5 |
| 2540600 |
If the clagd-vxlan-anycast-ip is removed from the /etc/network/interfaces file (either with the NCLU command or by editing the file manually), MLAG still believes it is present until clagd restarts. |
3.7.3-3.7.8 | 3.7.9-3.7.16, 4.0.0-4.4.5 |
| 2540557 |
On Trident3 switches, transit packets larger than 1500 bytes(DF) routed between SVIs is unexpectedly forwarded to the CPU even when the MTU is greater than 9000. This severely limits throughput for routed jumbo frames as packets arriving at a high interval are dropped to the CPU. | 3.7.0-3.7.16 | |
| 2540520 |
When IGMP snooping is enabled on a Broadcom switch, after multiple PIM join and leave messages are sent, switchd crashes and reports log messages similar to the following:
|
3.7.4 | 3.7.5-3.7.16 |
| 2540510 |
When traffic is routed by the VRR IP of an SVI, forward chain traffic is erroneously matched to input chain ACLs. | 3.7.3-3.7.5 | 3.7.6-3.7.16 |
| 2540496 |
Tomahawk or Tomahawk+ switches drop traffic when using EVPN centralized routing. | 3.7.4 | 3.7.5-3.7.16 |
| 2540486 |
Routes configured in the non-default VRF are not installed in hardware. Restarting switchd or rebooting the switch does not resolve the issue. This issue was discovered on the Helix4 switch but applies to all switches. In Cumulus Linux 3.7.5 and earlier, do not include the string eth in non-management interface names; routes associated with those interfaces might not be installed in hardware. |
3.7.3-3.7.5 | 3.7.6-3.7.16 |
| 2540464 |
If you have dynamic route leaking configured between any two VRFs and the BGP instance for the default VRF is not defined, removing an import vrf statement crashes bgpd. This occurs even if neither of the leaking VRFs are the default VRF. |
3.7.4-3.7.6 | 3.7.7-3.7.16 |
| 2540444 |
SNMP incorrectly requires engine ID specification. |
3.7.4-3.7.16, 4.0.0-4.4.5 | |
| 2540352 |
When you use NCLU to configure a route map, the parser allows for glob matching of interfaces for a match interface condition when there can only be a single interface matched. The proper syntax is to use multiple route map clauses, each matching a single interface, instead of a single clause matching multiple interfaces. For example, this command is incorrect:
These commands are correct:
|
3.7.2-3.7.16, 4.0.0-4.4.5 | |
| 2540340 |
NCLU allows for the configuration of addresses on VRF interfaces, but tab completion for the net add vrf command just displays
Tab completion for the net add vrf command works correctly. |
3.7.4-3.7.16, 4.0.0-4.4.5 | |
| 2540288 |
The switchd service crashes when you add a route with a nexhop label. |
3.7.3-3.7.5 | 3.7.6-3.7.16 |
| 2540268 |
An incorrect readout of the optical transceiver high temperature alarm threshold (read as 17 degrees centigrade), disables a 100G optical module on Mellanox Spectrum switches. | 3.7.2-3.7.6 | 3.7.7-3.7.16 |
| 2540254 |
In an EVPN centralized routing deployment, the border leaf sends out incorrect packets when flapping the VLAN interface. | 3.7.2-3.7.5 | 3.7.6-3.7.16 |
| 2540204 |
When links come up after FRR is started, VRF connected routes do not get redistributed. | 3.7.4-3.7.16, 4.0.0-4.4.5 | |
| 2540192 |
The net del bridge bridge mcsnoop yes command does not return the value to the default of disabled. To work around this issue, use the net add bridge bridge mcsnoop no command to delete the mcsnoop attribute and return to the default value. |
3.7.4-3.7.16, 4.0.0-4.4.5 | |
| 2540155 |
On the Broadcom switch, when moving configuration from bridged to routed (or toggling from routed to bridged to routed), some traffic is not seen by the kernel. This can cause BGP to not establish on a transit node. |
3.7.3-3.7.16, 4.0.0-4.4.5 | |
| 2540122 |
The snmpd daemon sometimes crashes with the error Unknown operation 6 in agentx_got_response. |
3.7.2-3.7.5 | 3.7.6-3.7.16 |
| 2540045 |
After adding or removing a VLAN from a VLAN-aware bridge or from a trunk either using the NCLU command or manually editing the /etc/network/interfaces file and running ifreload -a, an SVI bound to a different VLAN loses its IPv4 address defined in the /etc/network/interfaces file. |
3.7.3-3.7.5 | 3.7.6-3.7.16 |
| 2540042 |
When you try to configure the VRRP priority and advertisement-interval with NCLU on a traditional mode bridge, the net commit command fails. To work around this issue, use the vtysh command (inside FRR) to change the VRRP priority or advertisement-interval on traditional bridges. For example:
|
3.7.4-3.7.16, 4.0.0-4.4.5 | |
| 2540041 |
On SVIs in a VLAN-aware bridge, you cannot change the VRRP priority with NCLU. To work around this issue, run the vtysh command inside FRR to change the default priority. For example:
|
3.7.4-3.7.16, 4.0.0-4.4.5 | |
| 2540040 |
Cumulus Linux uses VRRPv3 as the default version, and enables both preempt and accept mode by default. You cannot change these default values with NCLU. To work around this issue, run the vtysh commands (inside FRR) to change the default values. For example:
|
3.7.4-3.7.16, 4.0.0-4.4.5 | |
| 2540031 |
NCLU does not honor auto all in the /etc/network/interfaces file and removes the existing configuration if no individual auto lines exist. |
3.7.3-3.7.16, 4.0.0-4.4.5 | |
| 2540017 |
The net commit command fails when you try to add a static voice VLAN or delete dot1x configuration for an interface when the port is already authorized. |
3.7.4-3.7.6 | 3.7.7-3.7.16 |
| 2539994 |
When you try to remove a BGP peer group configuration with NCLU, the command fails but no warning message is shown. For example:
|
3.7.2-3.7.16, 4.0.0-4.4.5 | |
| 2539962 |
When an LDAP user that does not have NCLU privileges (either in the netshow or netedit group, or in the /etc/netd.conf file) runs an NCLU command, a traceback occurs instead of a permissions error. |
3.7.0-3.7.16, 4.0.0-4.4.5 | |
| 2539928 |
When you delete or add 802.1X configuration on a port in a traditional mode bridge, all the ports are removed from the bridge. | 3.7.4-3.7.6 | 3.7.7-3.7.16 |
| 2539686 |
The Cumulus Linux switch sometimes sends out ARP request packets with the sender IP address set to 0.0.0.0. | 3.7.2-3.7.6 | 3.7.7-3.7.16 |
| 2539670 |
On the Edgecore 4610-54P switch, automatic medium-dependent interface crossover (auto-MDIX) stops working on a 100M full duplex interface and does not detect the required cable connection type. |
3.7.2-3.7.16, 4.0.0-4.4.5 | |
| 2539433 |
If multiple files reference the same module, ifupdown2 user-defined policy overrides do not apply. | 3.7.0-3.7.6 | 3.7.7-3.7.16 |
| 2539422 |
In FRR, you can remove the default BGP instance even if there are other instances that depend on it, which causes configuration issues. | 3.7.3-3.7.6 | 3.7.7-3.7.16 |
| 2539218 |
On the Mellanox SN2700 switch, the 100G-LR4 port might have problems establishing a link over a long distance (around 500 miles) through a telco service provider after a flap. If the laser is forced up by the link provider’s equipment, the circuit comes up. However, the circuit cannot survive a flap and the link remains down after a flap event. However, you might have to explicitly disable auto-negotiation and FEC in this scenario. | 3.7.2-3.7.6 | 3.7.7-3.7.16 |
| 2539169 |
On the QuantaMesh T1048-LY4R, smonctl reports that all power supplies are absent:
|
3.7.3-3.7.6 | 3.7.7-3.7.16 |
| 2539124 |
The net add interface command adds no ptm-enable for that interface in the frr.conf file. Running the net add or the net del command does not remove no ptm-enable from the frr.conf file. You have to remove it manually using vtysh. |
3.7.2-3.7.16, 4.0.0-4.4.5 | |
| 2539081 |
When you delete post-up and pre-down IP peer entries from the etc/network/interfaces file, then run the ifreload command, the IP addresses are not removed and the route remains in the route table. To work around this issue, either delete the IP addresses without the /32 mask component or flush the IP addresses for the interface with the ip addr flush dev command. |
3.7.0-3.7.16 | 4.0.0-4.4.5 |
| 2538980 |
A dummy interface does not inherit the MTU from a defaults file in /etc/network/ifupdown2/policy.d. A dummy interface is typically used to keep SVI interfaces up when there are no switch ports up that are associated with that VLAN. |
3.7.2-3.7.6 | 3.7.7-3.7.16 |
| 2538910 |
In a layer 2 VXLAN configuration, where each ECMP path is a layer 3 LACP bond with multiple port members, ECMP hash appears fine for data traffic over VXLAN from one VTEP to another, but the LACP hash is unbalanced. | 3.7.1-3.7.6 | 3.7.7-3.7.16 |
| 2538875 |
IPv6 multicast traffic destined to an unregistered multicast group is flooded to all ports in a bridge despite the bridge.optimized_mcast_flood = TRUE setting in the /etc/cumulus/swichd.conf file. |
3.7.2-3.7.16 | |
| 2538790 |
NCLU automatically adds the VLAN ID (for the layer 3 VNI/SVI) to the bridge when you run net add vxlan . This configuration breaks network connectivity in an EVPN symmetric routing configuration using MLAG. To restore connectivity, remove the VLAN ID from the bridge. |
3.7.2-3.7.16, 4.0.0-4.4.5 | |
| 2538756 |
When you flap a VNI with ifdown vni and ifup vni, the value of all MTUs for the SVI lowers to 1500 regardless of the default value set in the /etc/network/ifupdown2/policy.d/mtu.json file. This behavior does not occur if you flap the link with ip link set vni down. |
3.7.2-3.7.6 | 3.7.7-3.7.16 |
| 2538741 |
The NCLU command net show bridge spanning-tree does not show the MLAG peer link as part of the STP forwarding instance.To work around this issue, use the mstpctl command to confirm the STP status of the port. |
3.7.2-3.7.8 | 3.7.9-3.7.16 |
| 2538590 |
When you configure a control plane ACL to define permit and deny rules destined to the local switch, NCLU programs the control plane ACL rules into the FORWARD chain. |
3.7.2-3.7.16, 4.0.0-4.4.5 | |
| 2538562 |
On an RMP/1G-T switch, when you remove link-speed 100 with the NCLU command or by editing the etc/network/interfaces file to revert the 100M interface to the default (1G auto), the interface fails to recover and does not come back up.After you remove the link-speed, ethtool shows the advertised link modes as not reported and Speed/Duplex as unknown.To work around this issue and bring the interface back up, either restart switchd or use ethtool to configure the speed, advertised, duplex or MDI-X settings. Note: The advertised link mode gets set incorrectly if you include 1000baseT/Half. The port will come up successfully at 1G. |
3.7.2-3.7.16, 4.0.0-4.4.5 | |
| 2538480 |
Modifying the /etc/netd.conf file to set show_linux_command = True does not take effect. |
3.7.2-3.7.8 | 3.7.9-3.7.16 |
| 2538302 |
portwd allows an error to change the module type based on the error. For example, a bad write to a module might cause the module type to flap, which causes the link itself to flap. |
3.7.0-3.7.16 | |
| 2538294 |
If you use NCLU to create an iBGP peering across the peer link, running the net add bgp l2vpn evpn neighbor peerlink.4094 activate command creates a new eBGP neighborship when one has already been configured for iBGP. This is unexpected; the existing iBGP configuration is valid. |
3.7.0-3.7.16, 4.0.0-4.4.5 | |
| 2538256 |
On the Broadcom switch, when a link-local multicast frame is received on an access port with a VNI in the bridge, two copies of the packet are sent across the VNI to remote VTEPs and the receiving hosts observe duplicate packets. |
3.7.2-4.0.1 | 4.1.0-4.4.5 |
| 2538022 |
When you remove an interface from a bridge and add it to a VRF in the same commit/ifreload, the IPv6 link-local address is not created automatically. To work around this issue, do the change in two separate commits. First, remove the interface from the bridge, which causes it to be a layer 2 interface. Then, enslave the interface to the VRF. |
3.7.2-3.7.8 | 3.7.9-3.7.16 |
| 2537819 |
When you enable FEC (RS or BaseR) on an interface, removing the configuration from that interface does not revert the FEC status to off/none. |
3.7.2-3.7.16 | 4.0.0-4.4.5 |
| 2537806 |
Bridging ISIS traffic fails because layer 2 cache rules forward ISIS traffic to the CPU, where it is then dropped. To work around this issue, contact Customer Support. |
3.7.2-3.7.6 | 3.7.7-3.7.16 |
| 2537699 |
There is a limitation on the number of SVI interfaces you can specify as DHCP relay interfaces in the /etc/default/isc-dhcp-relay file. For example, 1500 SVI interfaces causes the dhcrelay service to exit without a core file and logs similar to the following are generated for the interfaces:
Eventually the dhcrelay service stops. |
3.7.1-3.7.16, 4.0.0-4.4.5 | |
| 2537544 |
When you run the mstpctl command, you might see the bridge-port state as blocking when it is actually disabled. You might see the same incorrect bridge-port state when other programs or tools use the output of mstpctl; for example, SNMP output from the BRIDGE-MIB. |
3.7.1-3.7.16, 4.0.0-4.4.5 | |
| 2537378 |
NCLU SNMPv3 user configuration (add, delete, modify) does not complete. Changes are made to the /etc/snmp/snmpd.conf file but the SNMPv3 user cache file /var/lib/snmp/snmpd.conf fails to update correctly and the configuration does not reflect in operation. To work around this issue, stop snmpd, remove the cache file, then restart snmpd. |
3.7.1-3.7.16 | |
| 2537188 |
When an event in the network, such as a switchd or networking service restart, leads to an OVSDB server high availability transition, an ovs-vtepd core might occur. This core generation has no effect on the functionality of high availability when the active OVSDB server is back in the network. |
3.7.2-3.7.16 | |
| 2537153 |
In rare cases, certain IPv6 BGP peers fail to reestablish after switchd restarts. |
3.7.2-3.7.8 | 3.7.9-3.7.16 |
| 2537104 |
When you try to stop hsflowd on the Trident II+ switch with the systemctl stop hsflowd command, the process hangs until you stop it with SIGKILL. |
3.7.1-3.7.16 | 4.0.0-4.4.5 |
| 2537061 |
The Dell S5048F-ON switch (with reverse airflow, rear to front), shows the Temp-3 sensor as absent. |
3.7.1-4.0.1 | 4.1.0-4.4.5 |
| 2536650 |
Mellanox Spectrum and Helix4 switches occasionally send malformed packets and do not send any flow samples (only counters). While this issue is fixed for switches with the Spectrum ASIC, this is a [known limitation|https://docs.cumulusnetworks.com/cumulus-linux/Monitoring-and-Troubleshooting/Network-Troubleshooting/Monitoring-System-Statistics-and-Network-Traffic-with-sFlow/#caveats-and-errata] on this Helix4 platform. |
3.7.0-3.7.8 | 3.7.9-3.7.16, 4.0.0-4.4.5 |
| 2536639 |
On a Dell S4048 switch, when you set the eth0 speed to 100, either with NCLU or by editing the /etc/network/interfaces file, the igb driver crashes, which brings down eth0. To work around this issue: * If eth0 is configured in the management VRF, power cycle the switch; the eth0 configuration fails and reverts back to the default (auto-negotiation/1000). * If eth0 is configured in the default VRF and you power cycle after the crash, igb continues to crash on boot up (before getting to login prompt); power-cycle the switch, select the Advanced option in GRUB to boot to recovery mode, then modify the /etc/network/interfaces file. |
3.7.0-3.7.16 | 4.0.0-4.4.5 |
| 2536608 |
Single tagged ARP requests received on a QinQ-over-VXLAN access port are dropped if ARP suppression is enabled on an unrelated VNI. |
3.7.0-3.7.16 | |
| 2536559 |
When deleting an interface using NCLU, if the /etc/network/interfaces alias is different than the /etc/frr/frr.conf description, the net commit command returns the following error:
Despite this error, the change is made and the description is removed from the frr.conf file. |
3.7.3-3.7.10 | 3.7.11-3.7.16 |
| 2536384 |
The BFD packet redirection logic used by OVSDB server high availability mode redirects BUM packets across the peer link. The iptables rule for redirection does differentiate between BFD and non-BFD VXLAN inner packets because the service node sends all frames with its own IP address as the tunnel source IP address. The VXLAN encapsulated BUM packets do not get forwarded to the CPU and do not go through the iptable redirection rule; only VXLAN encapsulated BFD packets get forwarded to the CPU due to the inner MAC DA lookup in hardware. |
3.7.0-3.7.16, 4.0.0-4.4.5 | |
| 2536230 |
On the Broadcom switch with the Trident3 ASIC, the ECN-CE bit is set by default on transit traffic. This might result in hosts adjusting traffic behavior if they are configured for the ECN feature. In Cumulus Linux 3.7.11, the default behavior changed; the ECN-CE bit is no longer set by default on transit traffic. |
3.7.3-3.7.10, 4.0.0-4.0.1 | 3.7.11-3.7.16, 4.1.0-4.4.5 |
| 2536179 |
On switches with the Trident 2+ ASIC, counters associated with VLANs and VRFs are not working. | 3.7.0-3.7.16, 4.0.0-4.4.5 | |
| 2535986 |
At a high CPU transmit traffic rate (for example, if there is unexpected CPU generated flooding or replication in software), when the ASIC packet driver cannot keep up with the transmit rate because there are no free DMA buffers, it can back pressure by suspending the switch port transmit queues. This can fill up the application socket buffers resulting in No buffer space available error messages on protocol sockets.When the driver recovers, it automatically resumes the transmit queues. In most cases these error messages are transient. In rare cases, the hardware queues might get stuck, which you can recover with a switchd restart. |
3.7.0-3.7.16, 4.0.0-4.4.5 | |
| 2535965 |
On the Trident3 switch, static PIM with IIF based on a layer 2 bridge does not work reliably. PIM Join via signaling is required for IPMC to work properly. To work around this issue, use dynamic signaling (joins) to manage IP multicast traffic. |
3.7.0-3.7.16, 4.0.0-4.4.5 | |
| 2534450 |
The default BGP instance must be provisioned and always exist for proper operation of dynamic leaking of routes between VRFs. | 3.7.0-3.7.16 | 4.0.0-4.4.5 |
| 2532924 |
The NetQ agent is bundled with Cumulus VX 3.4.3 and later; however, the NetQ agent is not bundled with Cumulus Linux 3.4.3 and later. The NetQ agent has been removed from Cumulus VX 3.7.7. The NetQ agent will be bundled with Cumulus Linux in a future release. | 3.7.0-3.7.6 | 3.7.7-3.7.16 |
Fixed Issues in 3.7.4
| Issue ID | Description | Affects |
|---|---|---|
| 2540133 |
The wrong route distinguisher is sent in an EVPN advertisement after a port flap. | 3.7.3 |
| 2539968 |
Permanent bridge FDB entries for a layer 3 VNI SVI are sometimes overwritten by an offload entry and sometimes missing. | 3.7.3 |
| 2539835 |
When an improperly programmed or corrupted module is inserted, the portwd service might crash due to an EEPROM transceiver code decoding problem and cannot be restarted. |
3.7.3 |
| 2539807 |
neighmgrd crashes and more than half the neighbor entries are in the FAILED state. Memory and CPU usage is high. |
3.7.2-3.7.3 |
| 2539753 |
Currently if the BMC firmware encounters a value that it cannot parse, it logs the following message, which provides insufficient data to understand which value failed to parse correctly and, therefore, how to further investigate the issue.
|
3.7.2-3.7.3 |
| 2539638 |
In an MLAG configuration, some prefixes are correlated with an incorrect VNI, which results in loss of redundant paths in the fabric for these prefixes. To work around this issue, restart FRR or perform a hard boot. | 3.7.2-3.7.3 |
| 2539222 |
Under certain conditions, EVPN next hops might not be removed when the contributing peer goes down or might not be populated when the BGP session to the contributing peer comes up. | 3.7.2-3.7.3 |
| 2539210 |
Both the current and maximum values for the HostTableEntries counter always poll as 0 even when cl-resource-query provides the correct value. |
|
| 2539148 |
On the platforms that require a port block to be configured as a set of 10G or 25G, if you do not configure the entire set, for example:
when you restart switchd, the service restarts and Cumulus Linux logs an error message into /var/log/switchd.log that is not clear. |
3.7.3 |
| 2539092 |
The switch forwards traffic destined to the MLAG paired switch SVI, then drops the traffic. | 3.7.2-3.7.3 |
| 2539075 |
When layer 2 VNIs are configured that terminate on Cisco switches at the edge, BUM traffic arriving on the Cisco switch is not being properly VXLAN encapsulated and forwarded to the Cumulus VTEPs. | 3.7.2-3.7.3 |
| 2539072 |
After upgrading to Cumulus Linux, the SNMP agent crashes when you call snmpbulkget. The SNMP agent will automatically restart and there is no impact to forwarding traffic. To work around this issue, do not call snmpbulkget where the response packet length is greater than the default maximum message length of 1472. |
3.7.2-3.7.3 |
| 2538977 |
The Dell Z9264F and Edgecore AS7816 switch does not support QSFP optical modules broken out to 4x individual interfaces. | |
| 2538965 |
On the Edgecore AS7816 switch, when you configure ports as 4x, the links for the ports do not come up and the port EEPROM cannot be read. | |
| 2538942 |
The EEPROM information changed on the Dell S5048F switch, which causes PCIe Bus Errors. | 3.7.2-3.7.3 |
| 2538884 |
cl-acltool -i fails to install LOG rules if either the source or destination (-d or -s) has multiple comma-separated values, such as:
You see errors similar to the following:
|
3.7.2-3.7.3 |
| 2538814 |
The permanent MAC entry that corresponds to the SVI of the layer 3 VNI (corresponding VLAN) is missing in the bridge FDB. | 3.7.0-3.7.3 |
| 2538737 |
When a MAC address is frozen, if the switch receives an update for that MAC address from a remote VTEP and the remote sequence number of that update is higher than its local sequence number, the switch programs that MAC address in the kernel bridge FDB as an offload entry reachable behind that remote VTEP. This occurs only when the MAC is moving across three or more VTEPs. | |
| 2538686 |
On Trident3 switches, not all ping requests match on the ingress ACL rule. | 3.7.3 |
| 2538651 |
On the Edgecore AS7816-64X switch, the fans might spin at high speeds even when the temperature is not high. | 3.7.3 |
| 2538594 |
EVPN supports a route map to control which routes in the BGP VRF routing table can inject into EVPN as type-5. This is supposed to operate properly on all common criteria handled by BGP route maps. However, when there is an attribute change that results in the route having to be filtered out, it does not remove the route from EVPN if previously obtained from there. | 3.7.2-3.7.3 |
| 2538206 |
You cannot currently disable FEC in Cumulus Linux on a Mellanox switch. | 3.7.1-3.7.3 |
| 2538054 |
On the Dell S4148 switch, if link pause is enabled in the /etc/cumulus/datapath/traffic.conf file, switchd fails to restart. |
3.7.0-3.7.3 |
| 2538013 |
When the peer link is lost and the backup IP address becomes inactive, the MLAG secondary switch brings up bonds but not VXLAN VNIs. | 3.7.1-3.7.3 |
| 2537918 |
When the Cumulus Linux switch has a BGP neighbor to a host running FRR 5.0, if the host FRR syslog is set to debugging and FRR is restarted, the BGP neighbor comes up according to the frr.log but on the switch, the BGP neighbor does not show in the show ip bgp vrf all summary command output (and other neighbor command output). Routes from the host appear fine, but the route map fails to get applied. To work around this issue, either run FRR 6.0 on host or avoid running debug logging. |
|
| 2537805 |
When you configure an IPv6 only neighbor with NCLU without the peer-group command, then execute the same commands again, the BGP session is reset. For example, if you run the following commands:
Cumulus Linux removes the net commands and adds the following line to FRR (using v6only remote-as), which causes BGP to flap.
This issue does not occur if you add the peer-group command; for example:
. |
3.7.0-3.7.3 |
| 2537409 |
It is not currently possible to bring up some 10G LR interfaces on Mellanox switches as auto-negotiation is set to on in hardware. |
3.7.1-3.7.3 |
| 2537111 |
The gshut community is not removed after you commit the configuration. |
3.7.0-3.7.3 |
| 2536470 |
Full support for resilient hashing on Broadcom Trident 3 switches is not yet available. | |
| 2536329 |
If a packet to an unknown IP address (but known network) enters the switch and matches an INPUT ACL rule, it is redirected for ARP and the counters increment for that rule, but it does not perform the action. This only happens until the ARP reply is sent, and then the traffic is forwarded properly. To work around this issue, change the rules to INPUT,FORWARD instead of INPUT. Drops should then be logged properly. |
|
| 2536107 |
On Tomahawk+ switches, the switchd process is unable to restart after configuring 2x25G in the /etc/cumulus/ports.conf file. |
|
| 2535216 |
If you add a bridge configuration on a routed (BGP unnumbered) switch port on a Mellanox switch, BGP remains up with routes exchanged or sent from the control plane, but packets received on this interface in the data plane are discarded in hardware. | 3.7.2-3.7.3 |
| 2535006 |
Virtual device counters are not working as expected. The TX counter increments but the RX counter does not. |
3.7.3 Release Notes
Open Issues in 3.7.3
| Issue ID | Description | Affects | Fixed |
|---|---|---|---|
| 3410952 |
If MLAG is configured but disconnected from an MLAG peer for an extended period of time (days or more), there is a long delay (up to a minute per day) before traffic forwarding stabilizes after the MLAG peer connection re-establishes. | 3.7.0-4.3.1 | 4.3.2-4.4.5, 5.5.0-5.15.0 |
| 3376798 |
On Broadcom switches, Cumulus Linux does not create the hardware bridging domain for a traditional bridge with a VXLAN interface during switchd restart. The /var/log/switchd.log file includes the following exception logs shortly after switchd restarts:switchd[30158]: hal_bcm_l3.c:1617 find_egr_path_if_vxlan_overlay:vxlan overlay : nh PORT: port <#>, vlanMAC learning looks correct, but traffic does not flow as expected. |
3.7.0-4.3.1 | 4.3.2-4.4.5 |
| 3330705 |
When using TACACS+, a TACACS+ server name that returns more than one IP address, such as an IPv6 and IPv4 address, is counted many times against the limit of seven TACACS+ servers, which might cause some of the later listed servers to be ignored as over the limit. To work around this issue, you can set the prefer_ip_version configuration option (the default value is 4) to choose between an IPv4 or IPv6 address if both are present. |
3.7.0-5.3.1 | 5.4.0-5.15.0 |
| 3327477 |
If you use su to change to a user specified through TACACS+, the user becomes the local tacacs0 thru tacacs15 user instead of the named user to run sudo commands. As a result, the named user password might not match the local tacacs0 thru tacacs15 user password. |
3.7.0-3.7.16, 4.0.0-4.4.5, 5.0.0-5.15.0 | |
| 3216921 |
RADIUS authenticated users with read-only access to NCLU commands (users in the users_with_show list) can run edit commands if a username for a non-local account is on the users_with_edit line of the /etc/netd.conf file. To work around this issue, make sure that all usernames on the users_with_edit line of the /etc/netd.conf file are configured local users for the system (real Linux users) |
3.7.0-3.7.16, 4.3.0-4.4.5 | |
| 3209699 |
RADIUS authenticated users with read-only access to NCLU commands (users in the users_with_show list) can run edit commands if a username for a non-local account is on the users_with_edit line of the /etc/netd.conf file. To work around this issue, make sure that all usernames on the users_with_edit line of the /etc/netd.conf file are configured local users for the system (real Linux users) |
3.7.0-4.3.0, 4.4.0-5.2.1 | 4.3.1, 5.3.0-5.15.0 |
| 2552739 |
Counters for IPROUTER rules do not increase when traffic is forwarded to the CPU because there is no IP neighbor. | 3.7.2-3.7.16 | |
| 2551675 |
When you restart clagd, the edge port setting on the peer link changes. |
3.7.2-4.2.0 | 4.2.1-4.4.5 |
| 2550323 |
After a neighbor is removed, the redistributed neighbor entry is withdrawn from the BGP table, but the prefix might still be selected as the bestpath when the host’s originated prefix is not advertised. To work around this issue, recreate the neighbor entry and flap the interface to the host. Or, if the host is already down, manually create a neighbor entry with an invalid MAC address, which forces redistribute neighbor to re-withdraw the entry. |
3.7.3-3.7.16 | 4.0.0-4.4.5 |
| 2548243 |
On switches with the Trident2+ ASIC, adding SPAN rules disables PBR rules. | 3.7.3-3.7.16, 4.0.0-4.4.5 | |
| 2546868 |
Broadcom Field Alert - SID - MMU 2B Errors A few of the MMU memories on Broadcom switches are grouped together with single parity control. During SER correction when a parity error occurs on one of those groups, other memory in that group might also report a SER error. This occurs when the memory is accessed either by a packet hit or through a schan operation. This issue can cause SER errors in other memory and cause traffic mis-forwarding or a packet drop. |
3.7.0-3.7.11, 4.0.0-4.0.1 | 3.7.12-3.7.16, 4.1.0-4.4.5 |
| 2546702 |
The FRR cl-support module times out on switches on the ARM platform even when the switch is not under heavy load. To work around this issue, run the cl-support -M command to disable timeouts. |
3.7.0-3.7.11, 4.0.0-4.0.1 | 3.7.12-3.7.16, 4.1.0-4.4.5 |
| 2545599 |
IPv6 table rules might affect forwarding. For example, if you create the following rule in the /etc/cumulus/acl/policy.d/03-sshd.rules file, the rule counter increments but IPv4 SSH traffic might be dropped.
|
3.7.2-3.7.11, 4.0.0-4.0.1 | 3.7.12-3.7.16, 4.1.0-4.4.5 |
| 2545235 |
On the Edgecore AS6812 switch, you might see rare I2C errors. | 3.7.2-3.7.10, 4.0.0-4.0.1 | 3.7.11-3.7.16, 4.1.0-4.4.5 |
| 2545132 |
On the Mellanox switch, ACL lookups are performed for VLAN matches when no rules with UNTAGGED match are present. |
3.7.2-3.7.10, 4.0.0-4.0.1 | 3.7.11-3.7.16, 4.1.0-4.4.5 |
| 2544212 |
Cumulus Linux poed generates excessive debug log entries. These will be reduced in a future release. | 3.7.3-3.7.10, 4.0.0-4.0.1 | 3.7.11-3.7.16, 4.1.0-4.4.5 |
| 2543727 |
ACL rules, such as the following, fail to install if you use swp+ (interfaces mentioned as wildcards).
You can now install such rules with swp+. |
3.7.3-3.7.16 | 4.0.0-4.4.5 |
| 2543211 |
In some cases, the switchd service might warn of excessive MAC moves from one switch port to itself (for example, from swp18 to swp18). |
3.7.0-3.7.16, 4.0.0-4.4.5 | |
| 2543113 |
NCLU restarts FRR when attempting to remove a BGP VRF stanza. This happens regardless of whether the VRF is valid/configured elsewhere on the switch or the removal is successful. To work around this issue, remove the stanza using vtysh. |
3.7.3-3.7.16 | 4.0.0-4.4.5 |
| 2543044 |
Under certain conditions, EVPN next hops might not be removed when the contributing peer goes down or might not be populated when the BGP session to the contributing peer comes up. You can prevent EVPN next hops from not being removed when the contributing peer goes down by specifying static MAC addresses on all layer 3 VNIs. There is no workaround for preventing EVPN next hops from not being populated when the BGP session to the contributing peer comes up. |
3.7.2-3.7.16 | 4.0.0-4.4.5 |
| 2542871 |
After you issue the NCLU net del bgp vrf command and commit the change, Cumulus Linux does not remove the configuration from the /etc/frr/frr.conf file or the net show config commands. |
3.7.3-3.7.10, 4.0.0-4.0.1 | 3.7.11-3.7.16, 4.1.0-4.4.5 |
| 2542336 |
On the Mellanox SN2410 switch, switchd does not start. |
3.7.2-3.7.8 | 3.7.9-3.7.16 |
| 2542301 |
When first creating a bond and enslaving an interface, NCLU hides some of the bridge command suggestions, although they are still accepted. |
3.7.3-3.7.16, 4.0.0-4.4.5 | |
| 2541761 |
A TACACS privilege level 15 user mapped to tacacs15 cannot use net commands even though the user is part of the netedit and/or netshow user group. |
3.7.2-3.7.6 | 3.7.7-3.7.16 |
| 2541604 |
The snmpd service exits with a message similar to the following:
This problem might occur during or after network convergence events. For example, when bgpd needs to process a high number of updates and the CPU cannot keep up, bgpd is disconnected and agentx generates a core dump in snmpd due to a memory allocation problem. To work around this issue, disable agentx by commenting out the following lines in the /etc/snmp/snmpd.conf file. Then, restart the snmpd service with the systemctl restart snmpd command.
If you still want to poll the BGP4-MIB information, re-enable the bgp pass persist script by adding the following line in the /etc/snmp/snmpd.conf file:
|
3.7.2-3.7.8 | 3.7.9-3.7.16 |
| 2541090 |
The dhcrelay service crashes when the DHCP relay packet comes back from the server. To work around this issue, remove the –nl flag from the dhcrelay service. |
3.7.3-3.7.6 | 3.7.7-3.7.16 |
| 2540950 |
On the QuantaMesh T4048-IX8 or EdgeCore AS7326-56X switch, when using a 1000BASE-T SFP module, the module LEDs do not light to reflect link status. |
3.7.3-4.1.1 | 4.2.0-4.4.5 |
| 2540863 |
On the EdgeCore AS5812-54X switch, the PSU2 Fan1 fluctuates between OK and LOW. When the fan speed is reported as LOW, the RPM is shown as a negative number. |
3.7.3-3.7.16 | |
| 2540845 |
On the Dell Z9100-ON switch, smond reports various sensors going from OK to BAD or OK to ABSENT; then the sensors recover. |
3.7.1-3.7.5 | 3.7.6-3.7.16 |
| 2540843 |
On the Dell S3048 switch, ports with FEC disabled show as BaseR on boot up. | 3.7.3-3.7.6 | 3.7.7-3.7.16 |
| 2540830 |
On the Dell S5248F switch, packets forwarded to the CPU are corrupted. | 3.7.3-3.7.16 | |
| 2540827 |
The platform json file for the Dell S5048-ON switch is improperly populated. This creates an issue when trying to poll the inventory statistics with NetQ. | 3.7.3-3.7.5 | 3.7.6-3.7.16 |
| 2540737 |
When you commit a configuration change to a VXLAN layer 2 VNI in an MLAG configuration, the peer link on the MLAG secondary switch goes into an STP blocking state. | 3.7.2-3.7.6 | 3.7.7-3.7.16 |
| 2540684 |
On a Dell S5248F (Trident3) switch, packets from switch ports are forwarded to the CPU and are sometimes corrupted. The corruption might result in BGP peerings being down, which can lead to all VXLAN traffic to and from a node to be lost, causing an outage to dually connected hosts in a rack. To work around this issue, restart switchd. |
3.7.3-3.7.8 | 3.7.9-3.7.16, 4.0.0-4.4.5 |
| 2540600 |
If the clagd-vxlan-anycast-ip is removed from the /etc/network/interfaces file (either with the NCLU command or by editing the file manually), MLAG still believes it is present until clagd restarts. |
3.7.3-3.7.8 | 3.7.9-3.7.16, 4.0.0-4.4.5 |
| 2540557 |
On Trident3 switches, transit packets larger than 1500 bytes(DF) routed between SVIs is unexpectedly forwarded to the CPU even when the MTU is greater than 9000. This severely limits throughput for routed jumbo frames as packets arriving at a high interval are dropped to the CPU. | 3.7.0-3.7.16 | |
| 2540510 |
When traffic is routed by the VRR IP of an SVI, forward chain traffic is erroneously matched to input chain ACLs. | 3.7.3-3.7.5 | 3.7.6-3.7.16 |
| 2540486 |
Routes configured in the non-default VRF are not installed in hardware. Restarting switchd or rebooting the switch does not resolve the issue. This issue was discovered on the Helix4 switch but applies to all switches. In Cumulus Linux 3.7.5 and earlier, do not include the string eth in non-management interface names; routes associated with those interfaces might not be installed in hardware. |
3.7.3-3.7.5 | 3.7.6-3.7.16 |
| 2540352 |
When you use NCLU to configure a route map, the parser allows for glob matching of interfaces for a match interface condition when there can only be a single interface matched. The proper syntax is to use multiple route map clauses, each matching a single interface, instead of a single clause matching multiple interfaces. For example, this command is incorrect:
These commands are correct:
|
3.7.2-3.7.16, 4.0.0-4.4.5 | |
| 2540288 |
The switchd service crashes when you add a route with a nexhop label. |
3.7.3-3.7.5 | 3.7.6-3.7.16 |
| 2540268 |
An incorrect readout of the optical transceiver high temperature alarm threshold (read as 17 degrees centigrade), disables a 100G optical module on Mellanox Spectrum switches. | 3.7.2-3.7.6 | 3.7.7-3.7.16 |
| 2540254 |
In an EVPN centralized routing deployment, the border leaf sends out incorrect packets when flapping the VLAN interface. | 3.7.2-3.7.5 | 3.7.6-3.7.16 |
| 2540155 |
On the Broadcom switch, when moving configuration from bridged to routed (or toggling from routed to bridged to routed), some traffic is not seen by the kernel. This can cause BGP to not establish on a transit node. |
3.7.3-3.7.16, 4.0.0-4.4.5 | |
| 2540133 |
The wrong route distinguisher is sent in an EVPN advertisement after a port flap. | 3.7.3 | 3.7.4-3.7.16 |
| 2540122 |
The snmpd daemon sometimes crashes with the error Unknown operation 6 in agentx_got_response. |
3.7.2-3.7.5 | 3.7.6-3.7.16 |
| 2540045 |
After adding or removing a VLAN from a VLAN-aware bridge or from a trunk either using the NCLU command or manually editing the /etc/network/interfaces file and running ifreload -a, an SVI bound to a different VLAN loses its IPv4 address defined in the /etc/network/interfaces file. |
3.7.3-3.7.5 | 3.7.6-3.7.16 |
| 2540031 |
NCLU does not honor auto all in the /etc/network/interfaces file and removes the existing configuration if no individual auto lines exist. |
3.7.3-3.7.16, 4.0.0-4.4.5 | |
| 2539994 |
When you try to remove a BGP peer group configuration with NCLU, the command fails but no warning message is shown. For example:
|
3.7.2-3.7.16, 4.0.0-4.4.5 | |
| 2539968 |
Permanent bridge FDB entries for a layer 3 VNI SVI are sometimes overwritten by an offload entry and sometimes missing. | 3.7.3 | 3.7.4-3.7.16 |
| 2539962 |
When an LDAP user that does not have NCLU privileges (either in the netshow or netedit group, or in the /etc/netd.conf file) runs an NCLU command, a traceback occurs instead of a permissions error. |
3.7.0-3.7.16, 4.0.0-4.4.5 | |
| 2539835 |
When an improperly programmed or corrupted module is inserted, the portwd service might crash due to an EEPROM transceiver code decoding problem and cannot be restarted. |
3.7.3 | 3.7.4-3.7.16 |
| 2539807 |
neighmgrd crashes and more than half the neighbor entries are in the FAILED state. Memory and CPU usage is high. |
3.7.2-3.7.3 | 3.7.4-3.7.16 |
| 2539753 |
Currently if the BMC firmware encounters a value that it cannot parse, it logs the following message, which provides insufficient data to understand which value failed to parse correctly and, therefore, how to further investigate the issue.
|
3.7.2-3.7.3 | 3.7.4-3.7.16 |
| 2539686 |
The Cumulus Linux switch sometimes sends out ARP request packets with the sender IP address set to 0.0.0.0. | 3.7.2-3.7.6 | 3.7.7-3.7.16 |
| 2539670 |
On the Edgecore 4610-54P switch, automatic medium-dependent interface crossover (auto-MDIX) stops working on a 100M full duplex interface and does not detect the required cable connection type. |
3.7.2-3.7.16, 4.0.0-4.4.5 | |
| 2539638 |
In an MLAG configuration, some prefixes are correlated with an incorrect VNI, which results in loss of redundant paths in the fabric for these prefixes. To work around this issue, restart FRR or perform a hard boot. | 3.7.2-3.7.16 | |
| 2539433 |
If multiple files reference the same module, ifupdown2 user-defined policy overrides do not apply. | 3.7.0-3.7.6 | 3.7.7-3.7.16 |
| 2539422 |
In FRR, you can remove the default BGP instance even if there are other instances that depend on it, which causes configuration issues. | 3.7.3-3.7.6 | 3.7.7-3.7.16 |
| 2539222 |
Under certain conditions, EVPN next hops might not be removed when the contributing peer goes down or might not be populated when the BGP session to the contributing peer comes up. | 3.7.2-3.7.3 | 3.7.4-3.7.16 |
| 2539218 |
On the Mellanox SN2700 switch, the 100G-LR4 port might have problems establishing a link over a long distance (around 500 miles) through a telco service provider after a flap. If the laser is forced up by the link provider’s equipment, the circuit comes up. However, the circuit cannot survive a flap and the link remains down after a flap event. However, you might have to explicitly disable auto-negotiation and FEC in this scenario. | 3.7.2-3.7.6 | 3.7.7-3.7.16 |
| 2539169 |
On the QuantaMesh T1048-LY4R, smonctl reports that all power supplies are absent:
|
3.7.3-3.7.6 | 3.7.7-3.7.16 |
| 2539148 |
On the platforms that require a port block to be configured as a set of 10G or 25G, if you do not configure the entire set, for example:
when you restart switchd, the service restarts and Cumulus Linux logs an error message into /var/log/switchd.log that is not clear. |
3.7.3 | 3.7.4-3.7.16 |
| 2539124 |
The net add interface command adds no ptm-enable for that interface in the frr.conf file. Running the net add or the net del command does not remove no ptm-enable from the frr.conf file. You have to remove it manually using vtysh. |
3.7.2-3.7.16, 4.0.0-4.4.5 | |
| 2539092 |
The switch forwards traffic destined to the MLAG paired switch SVI, then drops the traffic. | 3.7.2-3.7.3 | 3.7.4-3.7.16 |
| 2539081 |
When you delete post-up and pre-down IP peer entries from the etc/network/interfaces file, then run the ifreload command, the IP addresses are not removed and the route remains in the route table. To work around this issue, either delete the IP addresses without the /32 mask component or flush the IP addresses for the interface with the ip addr flush dev command. |
3.7.0-3.7.16 | 4.0.0-4.4.5 |
| 2539075 |
When layer 2 VNIs are configured that terminate on Cisco switches at the edge, BUM traffic arriving on the Cisco switch is not being properly VXLAN encapsulated and forwarded to the Cumulus VTEPs. | 3.7.2-3.7.3 | 3.7.4-3.7.16 |
| 2539072 |
After upgrading to Cumulus Linux, the SNMP agent crashes when you call snmpbulkget. The SNMP agent will automatically restart and there is no impact to forwarding traffic. To work around this issue, do not call snmpbulkget where the response packet length is greater than the default maximum message length of 1472. |
3.7.2-3.7.3 | 3.7.4-3.7.16 |
| 2538980 |
A dummy interface does not inherit the MTU from a defaults file in /etc/network/ifupdown2/policy.d. A dummy interface is typically used to keep SVI interfaces up when there are no switch ports up that are associated with that VLAN. |
3.7.2-3.7.6 | 3.7.7-3.7.16 |
| 2538942 |
The EEPROM information changed on the Dell S5048F switch, which causes PCIe Bus Errors. | 3.7.2-3.7.3 | 3.7.4-3.7.16 |
| 2538910 |
In a layer 2 VXLAN configuration, where each ECMP path is a layer 3 LACP bond with multiple port members, ECMP hash appears fine for data traffic over VXLAN from one VTEP to another, but the LACP hash is unbalanced. | 3.7.1-3.7.6 | 3.7.7-3.7.16 |
| 2538884 |
cl-acltool -i fails to install LOG rules if either the source or destination (-d or -s) has multiple comma-separated values, such as:
You see errors similar to the following:
|
3.7.2-3.7.3 | 3.7.4-3.7.16 |
| 2538875 |
IPv6 multicast traffic destined to an unregistered multicast group is flooded to all ports in a bridge despite the bridge.optimized_mcast_flood = TRUE setting in the /etc/cumulus/swichd.conf file. |
3.7.2-3.7.16 | |
| 2538814 |
The permanent MAC entry that corresponds to the SVI of the layer 3 VNI (corresponding VLAN) is missing in the bridge FDB. | 3.7.0-3.7.16 | |
| 2538790 |
NCLU automatically adds the VLAN ID (for the layer 3 VNI/SVI) to the bridge when you run net add vxlan . This configuration breaks network connectivity in an EVPN symmetric routing configuration using MLAG. To restore connectivity, remove the VLAN ID from the bridge. |
3.7.2-3.7.16, 4.0.0-4.4.5 | |
| 2538756 |
When you flap a VNI with ifdown vni and ifup vni, the value of all MTUs for the SVI lowers to 1500 regardless of the default value set in the /etc/network/ifupdown2/policy.d/mtu.json file. This behavior does not occur if you flap the link with ip link set vni down. |
3.7.2-3.7.6 | 3.7.7-3.7.16 |
| 2538741 |
The NCLU command net show bridge spanning-tree does not show the MLAG peer link as part of the STP forwarding instance.To work around this issue, use the mstpctl command to confirm the STP status of the port. |
3.7.2-3.7.8 | 3.7.9-3.7.16 |
| 2538686 |
On Trident3 switches, not all ping requests match on the ingress ACL rule. | 3.7.3 | 3.7.4-3.7.16 |
| 2538651 |
On the Edgecore AS7816-64X switch, the fans might spin at high speeds even when the temperature is not high. | 3.7.3 | 3.7.4-3.7.16 |
| 2538594 |
EVPN supports a route map to control which routes in the BGP VRF routing table can inject into EVPN as type-5. This is supposed to operate properly on all common criteria handled by BGP route maps. However, when there is an attribute change that results in the route having to be filtered out, it does not remove the route from EVPN if previously obtained from there. | 3.7.2-3.7.3 | 3.7.4-3.7.16 |
| 2538590 |
When you configure a control plane ACL to define permit and deny rules destined to the local switch, NCLU programs the control plane ACL rules into the FORWARD chain. |
3.7.2-3.7.16, 4.0.0-4.4.5 | |
| 2538562 |
On an RMP/1G-T switch, when you remove link-speed 100 with the NCLU command or by editing the etc/network/interfaces file to revert the 100M interface to the default (1G auto), the interface fails to recover and does not come back up.After you remove the link-speed, ethtool shows the advertised link modes as not reported and Speed/Duplex as unknown.To work around this issue and bring the interface back up, either restart switchd or use ethtool to configure the speed, advertised, duplex or MDI-X settings. Note: The advertised link mode gets set incorrectly if you include 1000baseT/Half. The port will come up successfully at 1G. |
3.7.2-3.7.16, 4.0.0-4.4.5 | |
| 2538480 |
Modifying the /etc/netd.conf file to set show_linux_command = True does not take effect. |
3.7.2-3.7.8 | 3.7.9-3.7.16 |
| 2538302 |
portwd allows an error to change the module type based on the error. For example, a bad write to a module might cause the module type to flap, which causes the link itself to flap. |
3.7.0-3.7.16 | |
| 2538294 |
If you use NCLU to create an iBGP peering across the peer link, running the net add bgp l2vpn evpn neighbor peerlink.4094 activate command creates a new eBGP neighborship when one has already been configured for iBGP. This is unexpected; the existing iBGP configuration is valid. |
3.7.0-3.7.16, 4.0.0-4.4.5 | |
| 2538256 |
On the Broadcom switch, when a link-local multicast frame is received on an access port with a VNI in the bridge, two copies of the packet are sent across the VNI to remote VTEPs and the receiving hosts observe duplicate packets. |
3.7.2-4.0.1 | 4.1.0-4.4.5 |
| 2538206 |
You cannot currently disable FEC in Cumulus Linux on a Mellanox switch. | 3.7.1-3.7.3 | 3.7.4-3.7.16 |
| 2538054 |
On the Dell S4148 switch, if link pause is enabled in the /etc/cumulus/datapath/traffic.conf file, switchd fails to restart. |
3.7.0-3.7.3 | 3.7.4-3.7.16 |
| 2538022 |
When you remove an interface from a bridge and add it to a VRF in the same commit/ifreload, the IPv6 link-local address is not created automatically. To work around this issue, do the change in two separate commits. First, remove the interface from the bridge, which causes it to be a layer 2 interface. Then, enslave the interface to the VRF. |
3.7.2-3.7.8 | 3.7.9-3.7.16 |
| 2538013 |
When the peer link is lost and the backup IP address becomes inactive, the MLAG secondary switch brings up bonds but not VXLAN VNIs. | 3.7.1-3.7.3 | 3.7.4-3.7.16 |
| 2537819 |
When you enable FEC (RS or BaseR) on an interface, removing the configuration from that interface does not revert the FEC status to off/none. |
3.7.2-3.7.16 | 4.0.0-4.4.5 |
| 2537806 |
Bridging ISIS traffic fails because layer 2 cache rules forward ISIS traffic to the CPU, where it is then dropped. To work around this issue, contact Customer Support. |
3.7.2-3.7.6 | 3.7.7-3.7.16 |
| 2537805 |
When you configure an IPv6 only neighbor with NCLU without the peer-group command, then execute the same commands again, the BGP session is reset. For example, if you run the following commands:
Cumulus Linux removes the net commands and adds the following line to FRR (using v6only remote-as), which causes BGP to flap.
This issue does not occur if you add the peer-group command; for example:
. |
3.7.0-3.7.3 | 3.7.4-3.7.16 |
| 2537699 |
There is a limitation on the number of SVI interfaces you can specify as DHCP relay interfaces in the /etc/default/isc-dhcp-relay file. For example, 1500 SVI interfaces causes the dhcrelay service to exit without a core file and logs similar to the following are generated for the interfaces:
Eventually the dhcrelay service stops. |
3.7.1-3.7.16, 4.0.0-4.4.5 | |
| 2537544 |
When you run the mstpctl command, you might see the bridge-port state as blocking when it is actually disabled. You might see the same incorrect bridge-port state when other programs or tools use the output of mstpctl; for example, SNMP output from the BRIDGE-MIB. |
3.7.1-3.7.16, 4.0.0-4.4.5 | |
| 2537409 |
It is not currently possible to bring up some 10G LR interfaces on Mellanox switches as auto-negotiation is set to on in hardware. |
3.7.1-3.7.3 | 3.7.4-3.7.16 |
| 2537378 |
NCLU SNMPv3 user configuration (add, delete, modify) does not complete. Changes are made to the /etc/snmp/snmpd.conf file but the SNMPv3 user cache file /var/lib/snmp/snmpd.conf fails to update correctly and the configuration does not reflect in operation. To work around this issue, stop snmpd, remove the cache file, then restart snmpd. |
3.7.1-3.7.16 | |
| 2537188 |
When an event in the network, such as a switchd or networking service restart, leads to an OVSDB server high availability transition, an ovs-vtepd core might occur. This core generation has no effect on the functionality of high availability when the active OVSDB server is back in the network. |
3.7.2-3.7.16 | |
| 2537153 |
In rare cases, certain IPv6 BGP peers fail to reestablish after switchd restarts. |
3.7.2-3.7.8 | 3.7.9-3.7.16 |
| 2537111 |
The gshut community is not removed after you commit the configuration. |
3.7.0-3.7.3 | 3.7.4-3.7.16 |
| 2537104 |
When you try to stop hsflowd on the Trident II+ switch with the systemctl stop hsflowd command, the process hangs until you stop it with SIGKILL. |
3.7.1-3.7.16 | 4.0.0-4.4.5 |
| 2537061 |
The Dell S5048F-ON switch (with reverse airflow, rear to front), shows the Temp-3 sensor as absent. |
3.7.1-4.0.1 | 4.1.0-4.4.5 |
| 2536650 |
Mellanox Spectrum and Helix4 switches occasionally send malformed packets and do not send any flow samples (only counters). While this issue is fixed for switches with the Spectrum ASIC, this is a [known limitation|https://docs.cumulusnetworks.com/cumulus-linux/Monitoring-and-Troubleshooting/Network-Troubleshooting/Monitoring-System-Statistics-and-Network-Traffic-with-sFlow/#caveats-and-errata] on this Helix4 platform. |
3.7.0-3.7.8 | 3.7.9-3.7.16, 4.0.0-4.4.5 |
| 2536639 |
On a Dell S4048 switch, when you set the eth0 speed to 100, either with NCLU or by editing the /etc/network/interfaces file, the igb driver crashes, which brings down eth0. To work around this issue: * If eth0 is configured in the management VRF, power cycle the switch; the eth0 configuration fails and reverts back to the default (auto-negotiation/1000). * If eth0 is configured in the default VRF and you power cycle after the crash, igb continues to crash on boot up (before getting to login prompt); power-cycle the switch, select the Advanced option in GRUB to boot to recovery mode, then modify the /etc/network/interfaces file. |
3.7.0-3.7.16 | 4.0.0-4.4.5 |
| 2536608 |
Single tagged ARP requests received on a QinQ-over-VXLAN access port are dropped if ARP suppression is enabled on an unrelated VNI. |
3.7.0-3.7.16 | |
| 2536559 |
When deleting an interface using NCLU, if the /etc/network/interfaces alias is different than the /etc/frr/frr.conf description, the net commit command returns the following error:
Despite this error, the change is made and the description is removed from the frr.conf file. |
3.7.3-3.7.10 | 3.7.11-3.7.16 |
| 2536384 |
The BFD packet redirection logic used by OVSDB server high availability mode redirects BUM packets across the peer link. The iptables rule for redirection does differentiate between BFD and non-BFD VXLAN inner packets because the service node sends all frames with its own IP address as the tunnel source IP address. The VXLAN encapsulated BUM packets do not get forwarded to the CPU and do not go through the iptable redirection rule; only VXLAN encapsulated BFD packets get forwarded to the CPU due to the inner MAC DA lookup in hardware. |
3.7.0-3.7.16, 4.0.0-4.4.5 | |
| 2536230 |
On the Broadcom switch with the Trident3 ASIC, the ECN-CE bit is set by default on transit traffic. This might result in hosts adjusting traffic behavior if they are configured for the ECN feature. In Cumulus Linux 3.7.11, the default behavior changed; the ECN-CE bit is no longer set by default on transit traffic. |
3.7.3-3.7.10, 4.0.0-4.0.1 | 3.7.11-3.7.16, 4.1.0-4.4.5 |
| 2536179 |
On switches with the Trident 2+ ASIC, counters associated with VLANs and VRFs are not working. | 3.7.0-3.7.16, 4.0.0-4.4.5 | |
| 2535986 |
At a high CPU transmit traffic rate (for example, if there is unexpected CPU generated flooding or replication in software), when the ASIC packet driver cannot keep up with the transmit rate because there are no free DMA buffers, it can back pressure by suspending the switch port transmit queues. This can fill up the application socket buffers resulting in No buffer space available error messages on protocol sockets.When the driver recovers, it automatically resumes the transmit queues. In most cases these error messages are transient. In rare cases, the hardware queues might get stuck, which you can recover with a switchd restart. |
3.7.0-3.7.16, 4.0.0-4.4.5 | |
| 2535965 |
On the Trident3 switch, static PIM with IIF based on a layer 2 bridge does not work reliably. PIM Join via signaling is required for IPMC to work properly. To work around this issue, use dynamic signaling (joins) to manage IP multicast traffic. |
3.7.0-3.7.16, 4.0.0-4.4.5 | |
| 2535216 |
If you add a bridge configuration on a routed (BGP unnumbered) switch port on a Mellanox switch, BGP remains up with routes exchanged or sent from the control plane, but packets received on this interface in the data plane are discarded in hardware. | 3.7.2-3.7.3 | 3.7.4-3.7.16 |
| 2534450 |
The default BGP instance must be provisioned and always exist for proper operation of dynamic leaking of routes between VRFs. | 3.7.0-3.7.16 | 4.0.0-4.4.5 |
| 2532924 |
The NetQ agent is bundled with Cumulus VX 3.4.3 and later; however, the NetQ agent is not bundled with Cumulus Linux 3.4.3 and later. The NetQ agent has been removed from Cumulus VX 3.7.7. The NetQ agent will be bundled with Cumulus Linux in a future release. | 3.7.0-3.7.6 | 3.7.7-3.7.16 |
Fixed Issues in 3.7.3
| Issue ID | Description | Affects |
|---|---|---|
| 2547838 |
The link-down yes parameter in the /etc/network/interfaces file does not work on subinterfaces configured in a VRF. |
3.7.2 |
| 2539386 |
Traffic increments the FORWARD ACL rule counter, but nothing is logged to syslog. | |
| 2538538 |
EVPN prefixes retain the max-med on startup value after the timer expires. |
3.7.2 |
| 2538384 |
Log entries containing grep commands almost completely fill the var/log/openvswitch/ovs-vtepd.log file. |
3.7.2 |
| 2538343 |
In an EVPN symmetric routing deployment with active-active anycast IP configured, the next hop attribute is sometimes set to a unique address instead of the anycast IP address. To work around this issue, do not use default-originate ipv4; instead configure the network statements (recommended for small scale deployments). |
3.7.2 |
| 2538336 |
On Trident3 switches, the LR interface_mode for 25G optics is not set automatically. | 3.7.2 |
| 2538157 |
Many of the SFPs are not enabled until SFP_TX_ENABLE is set manually. | 3.7.2 |
| 2538150 |
If an interface is correctly configured according to the /etc/ptm.d/topology.dot file (pass), then the link goes down, ptmd still shows the cbl status as pass. |
3.7.2 |
| 2538093 |
In an EVPN asymmetric type 5 deployment, the EVPN arp-cache of the SVI on the remote leaf is incorrect on the local leaf, which causes a ping failure from the SVI on the remote leaf to the server attached on the local leaf in the same VLAN. | 3.7.2 |
| 2538086 |
On the Dell S4000 and S4148 switch, when you insert a 10G-BaseT module, portwd reports a failed reading. |
3.7.2 |
| 2538075 |
The kvm-clock module is missing in the kernel on the telemetry server. The system clock only advances one second for approximately every ten real-time seconds that pass. This stops NTP from being able to synchronize the clock. | 3.7.2 |
| 2538046 |
Both switches in an MLAG configuration show the correct MLAG role status; however mstpd shows that both switches are in the MLAG primary role, which causes constant STP recalculation, shows the peer link as the STP backup port role, and traffic as being blocked. |
|
| 2538042 |
If you add a route for a VRF with the ip route command, which writes to the /etc/frr/frr.conf file and then you reload frr, when you try to remove the route from the file, the route is not removed when frr reloads. . |
3.7.2 |
| 2538004 |
Cumulus VX images for versions 3.7.0 through 3.7.2 include a vagrant user, as the vagrant box format [requires it|https://www.vagrantup.com/docs/boxes/base.html#default-user-settings] in order to function. This user is not needed; remove the user from the following Cumulus VX images: * cumulus-linux-3.7.0-vx-amd64-qemu.qcow2 * cumulus-linux-3.7.0-vx-amd64-vbox.ova * cumulus-linux-3.7.0-vx-amd64-vmware.ova * cumulus-linux-3.7.1-vx-amd64-qemu.qcow2 * cumulus-linux-3.7.1-vx-amd64-vbox.ova * cumulus-linux-3.7.1-vx-amd64-vmware.ova * cumulus-linux-3.7.2-vx-amd64-qemu.qcow2 * cumulus-linux-3.7.2-vx-amd64-vbox.ova * cumulus-linux-3.7.2-vx-amd64-vmware.ova To remove the vagrant user, run:
|
3.7.0-3.7.2 |
| 2537982 |
When the /etc/hostapd.conf file does not exist, the following sequence of commands causes a traceback:
To work around this issue: # Create the /etc/hostapd.conf file with the following default contents:
# Issue the following commands to set the ownership and permissions:
|
3.7.2 |
| 2537977 |
After upgrading to Cumulus Linux 3.7.2, the BGP route map does not filter type-5 routes. | 3.7.2 |
| 2537919 |
In Cumulus Linux 3.7.2 and earlier, an ACL entry containing 0.0.0.0 as a match parameter is interpreted as a catchall address (0.0.0.0 = 0.0.0.0/0). However in Cumulus Linux 3.7.3 and later, an ACL entry containing 0.0.0.0 as a match parameter is interpreted as a single address (0.0.0.0 = 0.0.0.0/32). Review your ACLs and update as necessary to include the proper subnet mask. |
3.7.2 |
| 2537861 |
When booting the switch, the mlxfirmware upgrade fails because a call is made to a file that does not yet exist (the firmware information is not available). This upgrade failure prevents sx_sdk.service and switchd from starting. The switch boots but does not forward any traffic, causing a major outage. |
|
| 2537836 |
Running ifdown vlan or ip link set vlan down brings down a virtual interface but the interface always comes back up after you run the ifreload -a or net commit command. |
3.7.1-3.7.2 |
| 2537776 |
BGP crashes with the error bgp_parse_nexthop_update. |
3.7.2 |
| 2537641 |
On the Celestica RedstoneV switch, the hardware settings are incorrect on swp14 and swp22. | 3.7.0-3.7.2 |
| 2537543 |
When an IP neighbor entry for a host behind an access switch pair is in a FAILED state on a centralized gateway and does not get resolved, a forwarding failure might result. | |
| 2537520 |
The as-path is not propagating for EVPN type-5 prefixes until forced with a clear. |
|
| 2537384 |
FEC is set when another interface is changed because ifupdown2 does an invalid compare, then switchd modifies the configuration causing the link to flap. |
|
| 2537085 |
When you run the net add (bond|interface) command, NCLU does not add the port as a slave of the VLAN-aware bridge. |
3.7.1-3.7.2 |
| 2537077 |
Switch ports that are configured as MLAG interfaces, then deleted, go into protodown on state unexpectedly. To work around this issue, turn off protodown manually with the ip link command:
|
|
| 2537023 |
If a pluggable is removed from the Dell S5232F switch during a read transaction, the ocores driver gets stuck and no more i2c transactions are possible on that core. | |
| 2536730 |
When you run the net show counters json command, you see the following error if any value is Unknown:
To work around this issue, run the following command to clear out the semaphore file created by cl-netstat -c:
|
3.7.0-3.7.2 |
| 2536615 |
NCLU net show configuration commands does not display any output for IPv6 rsyslog hosts. |
3.7.0-3.7.2 |
| 2536614 |
NCLU net show configuration commands displays a net add syslog command with invalid syntax. For example, if you run the following commands:
then run�� net show configuration commands, the output of the command syntax is invalid. |
3.7.0-3.7.2 |
| 2536245 |
When using dynamic route leaking, software forwarding of packets fails between the connected source and destination. To work around this issue, configure the leak on a switch that does not have any locally-connected hosts. |
3.7.1-3.7.2 |
| 2536167 |
When RASH is enabled and an ECMP path is taken away using the ip link set command, traffic using that ECMP path is never moved to another path and is dropped permanently. |
|
| 2536070 |
This is due to a limitation between Cumulus Linux and the Mellanox hardware. Currently, on a Mellanox switch, Cumulus Linux supports only four ECMP containers with 1000 hash entries per container. | |
| 2535751 |
The NCLU net add and net commit commands change the interfaces file even if you add a service like snmp/hostname/etc. This causes an issue with automation. For example, Ansible runs handlers (ifreload -a for interfaces) during each push if the file being edited changes. |
3.7.0-3.7.2 |
| 2535415 |
The wrong route target/route distinguisher is sent in an EVPN advertisement after a port flap. | |
| 2535331 |
If you use NCLU to configure an ACL for eth0, you cannot designate it as an INPUT rule; the rule is automatically created as a FORWARD rule in the /etc/cumulus/acl/policy.d/50_nclu_acl.rules file. |
|
| 2535279 |
When links are not synchronized before associated routes, switchd shows the following error log:
|
|
| 2534444 |
When an interface is configured for OSPF/BGP unnumbered, the net show interface command shows NotConfigured instead of showing that it is unnumbered. |
|
| 2533933 |
When OSPF is originating a default route, and the command is removed from the process, then re-added, the router stops advertising the default route. Configuring the default-information originate command a second time causes it to start working. | |
| 2533039 |
Currently, Cumulus Linux does not program the remote network SVI IP address in the route table. As a result, you can’t ping the remote network gateway address; however, you can ping the hosts in that remote network. | 3.7.0-3.7.2 |
| 2530923 |
The upstream OVSDB VTEP schema has been updated multiple times and now contains a patch to support source-node replication. This patch is not included with the latest version of Cumulus Linux. |
3.7.2 Release Notes
Open Issues in 3.7.2
| Issue ID | Description | Affects | Fixed |
|---|---|---|---|
| 3410952 |
If MLAG is configured but disconnected from an MLAG peer for an extended period of time (days or more), there is a long delay (up to a minute per day) before traffic forwarding stabilizes after the MLAG peer connection re-establishes. | 3.7.0-4.3.1 | 4.3.2-4.4.5, 5.5.0-5.15.0 |
| 3376798 |
On Broadcom switches, Cumulus Linux does not create the hardware bridging domain for a traditional bridge with a VXLAN interface during switchd restart. The /var/log/switchd.log file includes the following exception logs shortly after switchd restarts:switchd[30158]: hal_bcm_l3.c:1617 find_egr_path_if_vxlan_overlay:vxlan overlay : nh PORT: port <#>, vlanMAC learning looks correct, but traffic does not flow as expected. |
3.7.0-4.3.1 | 4.3.2-4.4.5 |
| 3330705 |
When using TACACS+, a TACACS+ server name that returns more than one IP address, such as an IPv6 and IPv4 address, is counted many times against the limit of seven TACACS+ servers, which might cause some of the later listed servers to be ignored as over the limit. To work around this issue, you can set the prefer_ip_version configuration option (the default value is 4) to choose between an IPv4 or IPv6 address if both are present. |
3.7.0-5.3.1 | 5.4.0-5.15.0 |
| 3327477 |
If you use su to change to a user specified through TACACS+, the user becomes the local tacacs0 thru tacacs15 user instead of the named user to run sudo commands. As a result, the named user password might not match the local tacacs0 thru tacacs15 user password. |
3.7.0-3.7.16, 4.0.0-4.4.5, 5.0.0-5.15.0 | |
| 3216921 |
RADIUS authenticated users with read-only access to NCLU commands (users in the users_with_show list) can run edit commands if a username for a non-local account is on the users_with_edit line of the /etc/netd.conf file. To work around this issue, make sure that all usernames on the users_with_edit line of the /etc/netd.conf file are configured local users for the system (real Linux users) |
3.7.0-3.7.16, 4.3.0-4.4.5 | |
| 3209699 |
RADIUS authenticated users with read-only access to NCLU commands (users in the users_with_show list) can run edit commands if a username for a non-local account is on the users_with_edit line of the /etc/netd.conf file. To work around this issue, make sure that all usernames on the users_with_edit line of the /etc/netd.conf file are configured local users for the system (real Linux users) |
3.7.0-4.3.0, 4.4.0-5.2.1 | 4.3.1, 5.3.0-5.15.0 |
| 2552739 |
Counters for IPROUTER rules do not increase when traffic is forwarded to the CPU because there is no IP neighbor. | 3.7.2-3.7.16 | |
| 2551675 |
When you restart clagd, the edge port setting on the peer link changes. |
3.7.2-4.2.0 | 4.2.1-4.4.5 |
| 2547838 |
The link-down yes parameter in the /etc/network/interfaces file does not work on subinterfaces configured in a VRF. |
3.7.2 | 3.7.3-3.7.16 |
| 2546868 |
Broadcom Field Alert - SID - MMU 2B Errors A few of the MMU memories on Broadcom switches are grouped together with single parity control. During SER correction when a parity error occurs on one of those groups, other memory in that group might also report a SER error. This occurs when the memory is accessed either by a packet hit or through a schan operation. This issue can cause SER errors in other memory and cause traffic mis-forwarding or a packet drop. |
3.7.0-3.7.11, 4.0.0-4.0.1 | 3.7.12-3.7.16, 4.1.0-4.4.5 |
| 2546702 |
The FRR cl-support module times out on switches on the ARM platform even when the switch is not under heavy load. To work around this issue, run the cl-support -M command to disable timeouts. |
3.7.0-3.7.11, 4.0.0-4.0.1 | 3.7.12-3.7.16, 4.1.0-4.4.5 |
| 2545599 |
IPv6 table rules might affect forwarding. For example, if you create the following rule in the /etc/cumulus/acl/policy.d/03-sshd.rules file, the rule counter increments but IPv4 SSH traffic might be dropped.
|
3.7.2-3.7.11, 4.0.0-4.0.1 | 3.7.12-3.7.16, 4.1.0-4.4.5 |
| 2545235 |
On the Edgecore AS6812 switch, you might see rare I2C errors. | 3.7.2-3.7.10, 4.0.0-4.0.1 | 3.7.11-3.7.16, 4.1.0-4.4.5 |
| 2545132 |
On the Mellanox switch, ACL lookups are performed for VLAN matches when no rules with UNTAGGED match are present. |
3.7.2-3.7.10, 4.0.0-4.0.1 | 3.7.11-3.7.16, 4.1.0-4.4.5 |
| 2543211 |
In some cases, the switchd service might warn of excessive MAC moves from one switch port to itself (for example, from swp18 to swp18). |
3.7.0-3.7.16, 4.0.0-4.4.5 | |
| 2543044 |
Under certain conditions, EVPN next hops might not be removed when the contributing peer goes down or might not be populated when the BGP session to the contributing peer comes up. You can prevent EVPN next hops from not being removed when the contributing peer goes down by specifying static MAC addresses on all layer 3 VNIs. There is no workaround for preventing EVPN next hops from not being populated when the BGP session to the contributing peer comes up. |
3.7.2-3.7.16 | 4.0.0-4.4.5 |
| 2542336 |
On the Mellanox SN2410 switch, switchd does not start. |
3.7.2-3.7.8 | 3.7.9-3.7.16 |
| 2541761 |
A TACACS privilege level 15 user mapped to tacacs15 cannot use net commands even though the user is part of the netedit and/or netshow user group. |
3.7.2-3.7.6 | 3.7.7-3.7.16 |
| 2541604 |
The snmpd service exits with a message similar to the following:
This problem might occur during or after network convergence events. For example, when bgpd needs to process a high number of updates and the CPU cannot keep up, bgpd is disconnected and agentx generates a core dump in snmpd due to a memory allocation problem. To work around this issue, disable agentx by commenting out the following lines in the /etc/snmp/snmpd.conf file. Then, restart the snmpd service with the systemctl restart snmpd command.
If you still want to poll the BGP4-MIB information, re-enable the bgp pass persist script by adding the following line in the /etc/snmp/snmpd.conf file:
|
3.7.2-3.7.8 | 3.7.9-3.7.16 |
| 2540845 |
On the Dell Z9100-ON switch, smond reports various sensors going from OK to BAD or OK to ABSENT; then the sensors recover. |
3.7.1-3.7.5 | 3.7.6-3.7.16 |
| 2540737 |
When you commit a configuration change to a VXLAN layer 2 VNI in an MLAG configuration, the peer link on the MLAG secondary switch goes into an STP blocking state. | 3.7.2-3.7.6 | 3.7.7-3.7.16 |
| 2540557 |
On Trident3 switches, transit packets larger than 1500 bytes(DF) routed between SVIs is unexpectedly forwarded to the CPU even when the MTU is greater than 9000. This severely limits throughput for routed jumbo frames as packets arriving at a high interval are dropped to the CPU. | 3.7.0-3.7.16 | |
| 2540352 |
When you use NCLU to configure a route map, the parser allows for glob matching of interfaces for a match interface condition when there can only be a single interface matched. The proper syntax is to use multiple route map clauses, each matching a single interface, instead of a single clause matching multiple interfaces. For example, this command is incorrect:
These commands are correct:
|
3.7.2-3.7.16, 4.0.0-4.4.5 | |
| 2540268 |
An incorrect readout of the optical transceiver high temperature alarm threshold (read as 17 degrees centigrade), disables a 100G optical module on Mellanox Spectrum switches. | 3.7.2-3.7.6 | 3.7.7-3.7.16 |
| 2540254 |
In an EVPN centralized routing deployment, the border leaf sends out incorrect packets when flapping the VLAN interface. | 3.7.2-3.7.5 | 3.7.6-3.7.16 |
| 2540122 |
The snmpd daemon sometimes crashes with the error Unknown operation 6 in agentx_got_response. |
3.7.2-3.7.5 | 3.7.6-3.7.16 |
| 2539994 |
When you try to remove a BGP peer group configuration with NCLU, the command fails but no warning message is shown. For example:
|
3.7.2-3.7.16, 4.0.0-4.4.5 | |
| 2539962 |
When an LDAP user that does not have NCLU privileges (either in the netshow or netedit group, or in the /etc/netd.conf file) runs an NCLU command, a traceback occurs instead of a permissions error. |
3.7.0-3.7.16, 4.0.0-4.4.5 | |
| 2539807 |
neighmgrd crashes and more than half the neighbor entries are in the FAILED state. Memory and CPU usage is high. |
3.7.2-3.7.3 | 3.7.4-3.7.16 |
| 2539753 |
Currently if the BMC firmware encounters a value that it cannot parse, it logs the following message, which provides insufficient data to understand which value failed to parse correctly and, therefore, how to further investigate the issue.
|
3.7.2-3.7.3 | 3.7.4-3.7.16 |
| 2539686 |
The Cumulus Linux switch sometimes sends out ARP request packets with the sender IP address set to 0.0.0.0. | 3.7.2-3.7.6 | 3.7.7-3.7.16 |
| 2539670 |
On the Edgecore 4610-54P switch, automatic medium-dependent interface crossover (auto-MDIX) stops working on a 100M full duplex interface and does not detect the required cable connection type. |
3.7.2-3.7.16, 4.0.0-4.4.5 | |
| 2539638 |
In an MLAG configuration, some prefixes are correlated with an incorrect VNI, which results in loss of redundant paths in the fabric for these prefixes. To work around this issue, restart FRR or perform a hard boot. | 3.7.2-3.7.16 | |
| 2539433 |
If multiple files reference the same module, ifupdown2 user-defined policy overrides do not apply. | 3.7.0-3.7.6 | 3.7.7-3.7.16 |
| 2539222 |
Under certain conditions, EVPN next hops might not be removed when the contributing peer goes down or might not be populated when the BGP session to the contributing peer comes up. | 3.7.2-3.7.3 | 3.7.4-3.7.16 |
| 2539218 |
On the Mellanox SN2700 switch, the 100G-LR4 port might have problems establishing a link over a long distance (around 500 miles) through a telco service provider after a flap. If the laser is forced up by the link provider’s equipment, the circuit comes up. However, the circuit cannot survive a flap and the link remains down after a flap event. However, you might have to explicitly disable auto-negotiation and FEC in this scenario. | 3.7.2-3.7.6 | 3.7.7-3.7.16 |
| 2539124 |
The net add interface command adds no ptm-enable for that interface in the frr.conf file. Running the net add or the net del command does not remove no ptm-enable from the frr.conf file. You have to remove it manually using vtysh. |
3.7.2-3.7.16, 4.0.0-4.4.5 | |
| 2539092 |
The switch forwards traffic destined to the MLAG paired switch SVI, then drops the traffic. | 3.7.2-3.7.3 | 3.7.4-3.7.16 |
| 2539081 |
When you delete post-up and pre-down IP peer entries from the etc/network/interfaces file, then run the ifreload command, the IP addresses are not removed and the route remains in the route table. To work around this issue, either delete the IP addresses without the /32 mask component or flush the IP addresses for the interface with the ip addr flush dev command. |
3.7.0-3.7.16 | 4.0.0-4.4.5 |
| 2539075 |
When layer 2 VNIs are configured that terminate on Cisco switches at the edge, BUM traffic arriving on the Cisco switch is not being properly VXLAN encapsulated and forwarded to the Cumulus VTEPs. | 3.7.2-3.7.3 | 3.7.4-3.7.16 |
| 2539072 |
After upgrading to Cumulus Linux, the SNMP agent crashes when you call snmpbulkget. The SNMP agent will automatically restart and there is no impact to forwarding traffic. To work around this issue, do not call snmpbulkget where the response packet length is greater than the default maximum message length of 1472. |
3.7.2-3.7.3 | 3.7.4-3.7.16 |
| 2538980 |
A dummy interface does not inherit the MTU from a defaults file in /etc/network/ifupdown2/policy.d. A dummy interface is typically used to keep SVI interfaces up when there are no switch ports up that are associated with that VLAN. |
3.7.2-3.7.6 | 3.7.7-3.7.16 |
| 2538942 |
The EEPROM information changed on the Dell S5048F switch, which causes PCIe Bus Errors. | 3.7.2-3.7.3 | 3.7.4-3.7.16 |
| 2538910 |
In a layer 2 VXLAN configuration, where each ECMP path is a layer 3 LACP bond with multiple port members, ECMP hash appears fine for data traffic over VXLAN from one VTEP to another, but the LACP hash is unbalanced. | 3.7.1-3.7.6 | 3.7.7-3.7.16 |
| 2538884 |
cl-acltool -i fails to install LOG rules if either the source or destination (-d or -s) has multiple comma-separated values, such as:
You see errors similar to the following:
|
3.7.2-3.7.3 | 3.7.4-3.7.16 |
| 2538875 |
IPv6 multicast traffic destined to an unregistered multicast group is flooded to all ports in a bridge despite the bridge.optimized_mcast_flood = TRUE setting in the /etc/cumulus/swichd.conf file. |
3.7.2-3.7.16 | |
| 2538814 |
The permanent MAC entry that corresponds to the SVI of the layer 3 VNI (corresponding VLAN) is missing in the bridge FDB. | 3.7.0-3.7.16 | |
| 2538790 |
NCLU automatically adds the VLAN ID (for the layer 3 VNI/SVI) to the bridge when you run net add vxlan . This configuration breaks network connectivity in an EVPN symmetric routing configuration using MLAG. To restore connectivity, remove the VLAN ID from the bridge. |
3.7.2-3.7.16, 4.0.0-4.4.5 | |
| 2538756 |
When you flap a VNI with ifdown vni and ifup vni, the value of all MTUs for the SVI lowers to 1500 regardless of the default value set in the /etc/network/ifupdown2/policy.d/mtu.json file. This behavior does not occur if you flap the link with ip link set vni down. |
3.7.2-3.7.6 | 3.7.7-3.7.16 |
| 2538741 |
The NCLU command net show bridge spanning-tree does not show the MLAG peer link as part of the STP forwarding instance.To work around this issue, use the mstpctl command to confirm the STP status of the port. |
3.7.2-3.7.8 | 3.7.9-3.7.16 |
| 2538594 |
EVPN supports a route map to control which routes in the BGP VRF routing table can inject into EVPN as type-5. This is supposed to operate properly on all common criteria handled by BGP route maps. However, when there is an attribute change that results in the route having to be filtered out, it does not remove the route from EVPN if previously obtained from there. | 3.7.2-3.7.3 | 3.7.4-3.7.16 |
| 2538590 |
When you configure a control plane ACL to define permit and deny rules destined to the local switch, NCLU programs the control plane ACL rules into the FORWARD chain. |
3.7.2-3.7.16, 4.0.0-4.4.5 | |
| 2538562 |
On an RMP/1G-T switch, when you remove link-speed 100 with the NCLU command or by editing the etc/network/interfaces file to revert the 100M interface to the default (1G auto), the interface fails to recover and does not come back up.After you remove the link-speed, ethtool shows the advertised link modes as not reported and Speed/Duplex as unknown.To work around this issue and bring the interface back up, either restart switchd or use ethtool to configure the speed, advertised, duplex or MDI-X settings. Note: The advertised link mode gets set incorrectly if you include 1000baseT/Half. The port will come up successfully at 1G. |
3.7.2-3.7.16, 4.0.0-4.4.5 | |
| 2538538 |
EVPN prefixes retain the max-med on startup value after the timer expires. |
3.7.2 | 3.7.3-3.7.16 |
| 2538480 |
Modifying the /etc/netd.conf file to set show_linux_command = True does not take effect. |
3.7.2-3.7.8 | 3.7.9-3.7.16 |
| 2538384 |
Log entries containing grep commands almost completely fill the var/log/openvswitch/ovs-vtepd.log file. |
3.7.2 | 3.7.3-3.7.16 |
| 2538343 |
In an EVPN symmetric routing deployment with active-active anycast IP configured, the next hop attribute is sometimes set to a unique address instead of the anycast IP address. To work around this issue, do not use default-originate ipv4; instead configure the network statements (recommended for small scale deployments). |
3.7.2 | 3.7.3-3.7.16, 4.0.0-4.4.5 |
| 2538336 |
On Trident3 switches, the LR interface_mode for 25G optics is not set automatically. | 3.7.2 | 3.7.3-3.7.16 |
| 2538302 |
portwd allows an error to change the module type based on the error. For example, a bad write to a module might cause the module type to flap, which causes the link itself to flap. |
3.7.0-3.7.16 | |
| 2538294 |
If you use NCLU to create an iBGP peering across the peer link, running the net add bgp l2vpn evpn neighbor peerlink.4094 activate command creates a new eBGP neighborship when one has already been configured for iBGP. This is unexpected; the existing iBGP configuration is valid. |
3.7.0-3.7.16, 4.0.0-4.4.5 | |
| 2538256 |
On the Broadcom switch, when a link-local multicast frame is received on an access port with a VNI in the bridge, two copies of the packet are sent across the VNI to remote VTEPs and the receiving hosts observe duplicate packets. |
3.7.2-4.0.1 | 4.1.0-4.4.5 |
| 2538206 |
You cannot currently disable FEC in Cumulus Linux on a Mellanox switch. | 3.7.1-3.7.3 | 3.7.4-3.7.16 |
| 2538157 |
Many of the SFPs are not enabled until SFP_TX_ENABLE is set manually. | 3.7.2 | 3.7.3-3.7.16 |
| 2538150 |
If an interface is correctly configured according to the /etc/ptm.d/topology.dot file (pass), then the link goes down, ptmd still shows the cbl status as pass. |
3.7.2 | 3.7.3-3.7.16 |
| 2538093 |
In an EVPN asymmetric type 5 deployment, the EVPN arp-cache of the SVI on the remote leaf is incorrect on the local leaf, which causes a ping failure from the SVI on the remote leaf to the server attached on the local leaf in the same VLAN. | 3.7.2 | 3.7.3-3.7.16 |
| 2538086 |
On the Dell S4000 and S4148 switch, when you insert a 10G-BaseT module, portwd reports a failed reading. |
3.7.2 | 3.7.3-3.7.16 |
| 2538075 |
The kvm-clock module is missing in the kernel on the telemetry server. The system clock only advances one second for approximately every ten real-time seconds that pass. This stops NTP from being able to synchronize the clock. | 3.7.2 | 3.7.3-3.7.16 |
| 2538054 |
On the Dell S4148 switch, if link pause is enabled in the /etc/cumulus/datapath/traffic.conf file, switchd fails to restart. |
3.7.0-3.7.3 | 3.7.4-3.7.16 |
| 2538042 |
If you add a route for a VRF with the ip route command, which writes to the /etc/frr/frr.conf file and then you reload frr, when you try to remove the route from the file, the route is not removed when frr reloads. . |
3.7.2 | 3.7.3-3.7.16 |
| 2538022 |
When you remove an interface from a bridge and add it to a VRF in the same commit/ifreload, the IPv6 link-local address is not created automatically. To work around this issue, do the change in two separate commits. First, remove the interface from the bridge, which causes it to be a layer 2 interface. Then, enslave the interface to the VRF. |
3.7.2-3.7.8 | 3.7.9-3.7.16 |
| 2538013 |
When the peer link is lost and the backup IP address becomes inactive, the MLAG secondary switch brings up bonds but not VXLAN VNIs. | 3.7.1-3.7.3 | 3.7.4-3.7.16 |
| 2538004 |
Cumulus VX images for versions 3.7.0 through 3.7.2 include a vagrant user, as the vagrant box format [requires it|https://www.vagrantup.com/docs/boxes/base.html#default-user-settings] in order to function. This user is not needed; remove the user from the following Cumulus VX images: * cumulus-linux-3.7.0-vx-amd64-qemu.qcow2 * cumulus-linux-3.7.0-vx-amd64-vbox.ova * cumulus-linux-3.7.0-vx-amd64-vmware.ova * cumulus-linux-3.7.1-vx-amd64-qemu.qcow2 * cumulus-linux-3.7.1-vx-amd64-vbox.ova * cumulus-linux-3.7.1-vx-amd64-vmware.ova * cumulus-linux-3.7.2-vx-amd64-qemu.qcow2 * cumulus-linux-3.7.2-vx-amd64-vbox.ova * cumulus-linux-3.7.2-vx-amd64-vmware.ova To remove the vagrant user, run:
|
3.7.0-3.7.2 | 3.7.3-3.7.16 |
| 2537982 |
When the /etc/hostapd.conf file does not exist, the following sequence of commands causes a traceback:
To work around this issue: # Create the /etc/hostapd.conf file with the following default contents:
# Issue the following commands to set the ownership and permissions:
|
3.7.2 | 3.7.3-3.7.16 |
| 2537977 |
After upgrading to Cumulus Linux 3.7.2, the BGP route map does not filter type-5 routes. | 3.7.2 | 3.7.3-3.7.16 |
| 2537919 |
In Cumulus Linux 3.7.2 and earlier, an ACL entry containing 0.0.0.0 as a match parameter is interpreted as a catchall address (0.0.0.0 = 0.0.0.0/0). However in Cumulus Linux 3.7.3 and later, an ACL entry containing 0.0.0.0 as a match parameter is interpreted as a single address (0.0.0.0 = 0.0.0.0/32). Review your ACLs and update as necessary to include the proper subnet mask. |
3.7.2 | 3.7.3-3.7.16 |
| 2537836 |
Running ifdown vlan or ip link set vlan down brings down a virtual interface but the interface always comes back up after you run the ifreload -a or net commit command. |
3.7.1-3.7.2 | 3.7.3-3.7.16 |
| 2537819 |
When you enable FEC (RS or BaseR) on an interface, removing the configuration from that interface does not revert the FEC status to off/none. |
3.7.2-3.7.16 | 4.0.0-4.4.5 |
| 2537806 |
Bridging ISIS traffic fails because layer 2 cache rules forward ISIS traffic to the CPU, where it is then dropped. To work around this issue, contact Customer Support. |
3.7.2-3.7.6 | 3.7.7-3.7.16 |
| 2537805 |
When you configure an IPv6 only neighbor with NCLU without the peer-group command, then execute the same commands again, the BGP session is reset. For example, if you run the following commands:
Cumulus Linux removes the net commands and adds the following line to FRR (using v6only remote-as), which causes BGP to flap.
This issue does not occur if you add the peer-group command; for example:
. |
3.7.0-3.7.3 | 3.7.4-3.7.16 |
| 2537776 |
BGP crashes with the error bgp_parse_nexthop_update. |
3.7.2 | 3.7.3-3.7.16 |
| 2537699 |
There is a limitation on the number of SVI interfaces you can specify as DHCP relay interfaces in the /etc/default/isc-dhcp-relay file. For example, 1500 SVI interfaces causes the dhcrelay service to exit without a core file and logs similar to the following are generated for the interfaces:
Eventually the dhcrelay service stops. |
3.7.1-3.7.16, 4.0.0-4.4.5 | |
| 2537641 |
On the Celestica RedstoneV switch, the hardware settings are incorrect on swp14 and swp22. | 3.7.0-3.7.2 | 3.7.3-3.7.16 |
| 2537544 |
When you run the mstpctl command, you might see the bridge-port state as blocking when it is actually disabled. You might see the same incorrect bridge-port state when other programs or tools use the output of mstpctl; for example, SNMP output from the BRIDGE-MIB. |
3.7.1-3.7.16, 4.0.0-4.4.5 | |
| 2537409 |
It is not currently possible to bring up some 10G LR interfaces on Mellanox switches as auto-negotiation is set to on in hardware. |
3.7.1-3.7.3 | 3.7.4-3.7.16 |
| 2537378 |
NCLU SNMPv3 user configuration (add, delete, modify) does not complete. Changes are made to the /etc/snmp/snmpd.conf file but the SNMPv3 user cache file /var/lib/snmp/snmpd.conf fails to update correctly and the configuration does not reflect in operation. To work around this issue, stop snmpd, remove the cache file, then restart snmpd. |
3.7.1-3.7.16 | |
| 2537188 |
When an event in the network, such as a switchd or networking service restart, leads to an OVSDB server high availability transition, an ovs-vtepd core might occur. This core generation has no effect on the functionality of high availability when the active OVSDB server is back in the network. |
3.7.2-3.7.16 | |
| 2537153 |
In rare cases, certain IPv6 BGP peers fail to reestablish after switchd restarts. |
3.7.2-3.7.8 | 3.7.9-3.7.16 |
| 2537111 |
The gshut community is not removed after you commit the configuration. |
3.7.0-3.7.3 | 3.7.4-3.7.16 |
| 2537104 |
When you try to stop hsflowd on the Trident II+ switch with the systemctl stop hsflowd command, the process hangs until you stop it with SIGKILL. |
3.7.1-3.7.16 | 4.0.0-4.4.5 |
| 2537085 |
When you run the net add (bond|interface) command, NCLU does not add the port as a slave of the VLAN-aware bridge. |
3.7.1-3.7.2 | 3.7.3-3.7.16 |
| 2537061 |
The Dell S5048F-ON switch (with reverse airflow, rear to front), shows the Temp-3 sensor as absent. |
3.7.1-4.0.1 | 4.1.0-4.4.5 |
| 2536730 |
When you run the net show counters json command, you see the following error if any value is Unknown:
To work around this issue, run the following command to clear out the semaphore file created by cl-netstat -c:
|
3.7.0-3.7.2 | 3.7.3-3.7.16 |
| 2536650 |
Mellanox Spectrum and Helix4 switches occasionally send malformed packets and do not send any flow samples (only counters). While this issue is fixed for switches with the Spectrum ASIC, this is a [known limitation|https://docs.cumulusnetworks.com/cumulus-linux/Monitoring-and-Troubleshooting/Network-Troubleshooting/Monitoring-System-Statistics-and-Network-Traffic-with-sFlow/#caveats-and-errata] on this Helix4 platform. |
3.7.0-3.7.8 | 3.7.9-3.7.16, 4.0.0-4.4.5 |
| 2536639 |
On a Dell S4048 switch, when you set the eth0 speed to 100, either with NCLU or by editing the /etc/network/interfaces file, the igb driver crashes, which brings down eth0. To work around this issue: * If eth0 is configured in the management VRF, power cycle the switch; the eth0 configuration fails and reverts back to the default (auto-negotiation/1000). * If eth0 is configured in the default VRF and you power cycle after the crash, igb continues to crash on boot up (before getting to login prompt); power-cycle the switch, select the Advanced option in GRUB to boot to recovery mode, then modify the /etc/network/interfaces file. |
3.7.0-3.7.16 | 4.0.0-4.4.5 |
| 2536615 |
NCLU net show configuration commands does not display any output for IPv6 rsyslog hosts. |
3.7.0-3.7.2 | 3.7.3-3.7.16 |
| 2536614 |
NCLU net show configuration commands displays a net add syslog command with invalid syntax. For example, if you run the following commands:
then run�� net show configuration commands, the output of the command syntax is invalid. |
3.7.0-3.7.2 | 3.7.3-3.7.16 |
| 2536608 |
Single tagged ARP requests received on a QinQ-over-VXLAN access port are dropped if ARP suppression is enabled on an unrelated VNI. |
3.7.0-3.7.16 | |
| 2536384 |
The BFD packet redirection logic used by OVSDB server high availability mode redirects BUM packets across the peer link. The iptables rule for redirection does differentiate between BFD and non-BFD VXLAN inner packets because the service node sends all frames with its own IP address as the tunnel source IP address. The VXLAN encapsulated BUM packets do not get forwarded to the CPU and do not go through the iptable redirection rule; only VXLAN encapsulated BFD packets get forwarded to the CPU due to the inner MAC DA lookup in hardware. |
3.7.0-3.7.16, 4.0.0-4.4.5 | |
| 2536245 |
When using dynamic route leaking, software forwarding of packets fails between the connected source and destination. To work around this issue, configure the leak on a switch that does not have any locally-connected hosts. |
3.7.1-3.7.2 | 3.7.3-3.7.16 |
| 2536179 |
On switches with the Trident 2+ ASIC, counters associated with VLANs and VRFs are not working. | 3.7.0-3.7.16, 4.0.0-4.4.5 | |
| 2535986 |
At a high CPU transmit traffic rate (for example, if there is unexpected CPU generated flooding or replication in software), when the ASIC packet driver cannot keep up with the transmit rate because there are no free DMA buffers, it can back pressure by suspending the switch port transmit queues. This can fill up the application socket buffers resulting in No buffer space available error messages on protocol sockets.When the driver recovers, it automatically resumes the transmit queues. In most cases these error messages are transient. In rare cases, the hardware queues might get stuck, which you can recover with a switchd restart. |
3.7.0-3.7.16, 4.0.0-4.4.5 | |
| 2535965 |
On the Trident3 switch, static PIM with IIF based on a layer 2 bridge does not work reliably. PIM Join via signaling is required for IPMC to work properly. To work around this issue, use dynamic signaling (joins) to manage IP multicast traffic. |
3.7.0-3.7.16, 4.0.0-4.4.5 | |
| 2535751 |
The NCLU net add and net commit commands change the interfaces file even if you add a service like snmp/hostname/etc. This causes an issue with automation. For example, Ansible runs handlers (ifreload -a for interfaces) during each push if the file being edited changes. |
3.7.0-3.7.2 | 3.7.3-3.7.16 |
| 2535216 |
If you add a bridge configuration on a routed (BGP unnumbered) switch port on a Mellanox switch, BGP remains up with routes exchanged or sent from the control plane, but packets received on this interface in the data plane are discarded in hardware. | 3.7.2-3.7.3 | 3.7.4-3.7.16 |
| 2534450 |
The default BGP instance must be provisioned and always exist for proper operation of dynamic leaking of routes between VRFs. | 3.7.0-3.7.16 | 4.0.0-4.4.5 |
| 2533039 |
Currently, Cumulus Linux does not program the remote network SVI IP address in the route table. As a result, you can’t ping the remote network gateway address; however, you can ping the hosts in that remote network. | 3.7.0-3.7.2 | 3.7.3-3.7.16 |
| 2532924 |
The NetQ agent is bundled with Cumulus VX 3.4.3 and later; however, the NetQ agent is not bundled with Cumulus Linux 3.4.3 and later. The NetQ agent has been removed from Cumulus VX 3.7.7. The NetQ agent will be bundled with Cumulus Linux in a future release. | 3.7.0-3.7.6 | 3.7.7-3.7.16 |
Fixed Issues in 3.7.2
| Issue ID | Description | Affects |
|---|---|---|
| 2539912 |
The snmpd service fails and generates a core file when the service is stopped or restarted and there is a trapsess line configured. To work around this issue, comment out the trapsess lines. |
3.7.0-3.7.1 |
| 2538443 |
On the Dell S5048F and Dell Z9100 switches, the MODULE_DEVICE_TABLE declaration enables the kernel to auto load the drivers on any platform with a Xilinx 7021 device. As a result, these switches might exhibit errors in their dmseg logs when trying to auto load an incompatible driver. | 3.7.0-3.7.1 |
| 2537832 |
In an MLAG configuration, you might see the traceback AttributeError: ‘NoneType’ object has no attribute ‘replace’. |
3.7.1 |
| 2537351 |
When installing a Cumulus Linux 3.6.1 through 3.7.1 image, the poed service is not enabled by default. |
|
| 2537302 |
After FEC is enabled on an interface, ifupdown2 invokes ethtool –set-fec, even if FEC is unchanged. For Broadcom switches, this might cause a link flap. |
|
| 2537038 |
When you run the NCLU net show system command on the Dell S5248F-ON switch, the output shows blank values for both CPU and Chipset:
|
3.7.0-3.7.1 |
| 2537028 |
Under certain conditions, DHCP relay produces a segmentation fault when used in an EVPN symmetric environment with the -U option. |
3.7.1 |
| 2536975 |
When you have certain options configured (such as PIM, MSDP, or ssmping), exit-vrf is copied beneath the vni line within the vrf stanza in the running vtysh configuration and in the /etc/frr/frr.conf file. This can cause a conflict; for example, if you are running PIM in the same VRF, the vni line is added above the ip pim rp line:
|
3.7.0-3.7.1 |
| 2536934 |
When installing an IPv6 onlink route, if the kernel has a default route and the gateway resolves out of the default route, the route is rejected if the passed in ifindex does not match. With IPv4, the default route match is ignored and the onlink based route is installed. |
|
| 2536833 |
When you use a Trident3 switch as the exit node, which is playing the role of the spine, pings to external hosts fail after a systemctl restart networking event. |
|
| 2536686 |
If you add the MTU to a VLAN with the NCLU net add vlan command, Cumulus Linux adds extra mtu lines in the /etc/network/interfaces file when there are defined bridge ports that do not exist elsewhere in the file. |
3.7.0-3.7.1 |
| 2536669 |
After attempting to install unsupported ICMPv6-type rules, the hardware sync fails with an Out of table resource message even after you correct the rules. |
3.7.0-3.7.1 |
| 2536520 |
When you run the net show system command on a Facebook Backpack switch, you see an error in netd.log:
|
3.7.0-3.7.1 |
| 2536489 |
On a Mellanox switch, when using an ECMP route over /31 interfaces, incorrect layer 3 neighbor and layer 3 route entries are shown. | |
| 2536481 |
On Mellanox switches, BFD packets share the same TRAP group (Trap Group 8) as other bulk IP2ME traffic. If traffic is flooded to the CPU (for example, because of route withdrawal) BFD packets are dropped. | |
| 2536463 |
The NCLU net del command fails to remove a message-digest-key from a subinterface in a VRF and displays an error message. |
|
| 2536454 |
Input chain ACLs do not apply in hardware on Broadcom platforms and input packets are processed against rules in the kernel instead. This can result in rules with the drop action not applying in hardware and the packets reaching the kernel. for platforms that do not provide native support for VXLAN routing (non-RIOT platforms). |
|
| 2536447 |
Add the DAS listener service to the /etc/vrf/systemd.conf file so it can be started in the management VRF as needed. |
3.7.0-3.7.1 |
| 2536412 |
If you configure a BGP community list using NCLU, it should set bgpd=yes if it is not already enabled. Communities are only used with BGP. If you try to configure a community (or extcommunity) before enabling bgpd (either by editing the /etc/frr/daemons file or by running other BGP NCLU commands), NCLU accepts the configuration and no warning is reported when committed. However, the configuration is not accepted by FRR. |
|
| 2536392 |
NCLU currently supports BGP prefix filtering via community and extcommunity, but not large-community, which are common in 4-Byte ASN environments. NCLU now supports large-community. |
|
| 2536366 |
When programming policy-based routing (PBR), if you change the input interface from a physical interface to a subinterface, the traffic is not properly redirected. You must flap the nexthop interface to reprogram the PBR. |
|
| 2536210 |
When you add ports as bridge ports multiple times with the NCLU command, the commits succeed without error. To work around this issue, remove the extra interfaces with the net del bridge bridge ports command. |
|
| 2536188 |
When you configure SNMP with NCLU commands, the SNMP server does not restart and you see a warning: WARNING: snmpd is not running. Run “journalctl -u snmpd” for error messages.To work around this issue, start SNMP manually. |
|
| 2536033 |
NCLU does not allow for configuration of link-speed 10 and does not parse any unrelated NCLU configuration when link-speed 10 is detected in the /etc/network/interfaces file. |
|
| 2535990 |
SNMPv3 TRAP passwords or encryption keys longer then 16 characters might result in a core dump. For example:
To work around this issue, use SNMPv3 TRAP passwords and encryption keys that are 16 characters or shorter. |
|
| 2535977 |
On the Trident 3 switch, cl-ecmpcalc returns invalid entries (two entries for MAC address 00:00:00:00:00:00) that cause script failures. |
|
| 2535947 |
ARP reply packets are flooded to all remote VTEPs when the ARP reply arrives on a different MLAG peer than the one where the permanent MAC exits. To work around this issue: # Manually define the MAC address for the SVI. The MAC address allocated to the SVI is inherited by the bridge (by default). The bridge inherits the MAC address from a physical interface (swp*). This inheritance might result in a different SVI MAC address after a reboot (for example, a configuration change might result in the port being removed from the bridge). For this example, the MAC address of SVI vlan123 is statically configured as sw01 = MM:MM:MM:11:11:11 and sw02 = MM:MM:MM:22:22:22. # Program a static entry on sw01 pointing to sw02 over the _peerlink_ bond in VLAN 123:
# Configure a static MAC address on sw02 pointing to the SVI owned by sw01 over the _peerlink_ bond in VLAN 123:
# Repeat steps above for each VLAN. |
|
| 2535877 |
Mellanox switches prefer a MAC entry learned through the VNI over a permanent entry for the corresponding SVI. | |
| 2535799 |
On the Mellanox Spectrum switch, VXLAN-encapsulated packets are not being forwarded. | |
| 2535733 |
If you insert a 1G LX module into an Edgecore 4610 or 5812 switch or reboot the switch with this module installed, no traffic is passed on the switch port when auto-negotiation is enabled. Flapping the link down or up does not repair it. To work around this issue, disable auto-negotiation, then re-enable it to repair the link; otherwise, disable auto-negotiation permanently. For example, if swp1 has the 1G module, disable then re-enable auto-negotiation as follows:
|
|
| 2535078 |
When you use NCLU to delete an interface, the associated configuration is not removed from the /etc/frr/frr.conf file. |
|
| 2534900 |
Removing a VLAN from a bridge configured with VXLAN causes a network service outage until the configuration change is reverted with the net rollback last command. To work around this issue, remove the VNI interface first, then remove the unused VLAN from the bridge. |
|
| 2533615 |
Configuring an IP address on any local layer 3 interface causes the interface IP address to be placed in the BGP martian next hop table. However, subsequent removal of that address from an interface does not remove it from the BGP martian next hop table. | |
| 2532608 |
On rare occasions, duplicate packets are seen in an EVPN configuration when routing between a dual-attached local host in one subnet and a remote host in another subnet. This is because the gateway VTEP does not have its VRR MAC address (anycast MAC address) configured on all gateway VTEPs in the bridge forwarding table Run the ifreload -a -X eth0 command to update the interface configuration on all gateway VTEPs. |
|
| 2531159 |
MLAG does not sync permanent MAC addresses between peers and nolearning is turned on; traffic with a next-hop pointing to the peerlink is forwarded to the CPU and throughput is limited. Permanent MAC address sync between MLAG peers is now supported. |
|
| 2529692 |
In some instances, ARP requests are not suppressed in a VXLAN active-active configuration but get flooded over VXLAN tunnels instead. This issue occurs because there is no control plane syncing the snooped local neighbor entries between the MLAG pair; MLAG does not perform this sync and neither does EVPN. |
3.7.1 Release Notes
Open Issues in 3.7.1
| Issue ID | Description | Affects | Fixed |
|---|---|---|---|
| 3410952 |
If MLAG is configured but disconnected from an MLAG peer for an extended period of time (days or more), there is a long delay (up to a minute per day) before traffic forwarding stabilizes after the MLAG peer connection re-establishes. | 3.7.0-4.3.1 | 4.3.2-4.4.5, 5.5.0-5.15.0 |
| 3376798 |
On Broadcom switches, Cumulus Linux does not create the hardware bridging domain for a traditional bridge with a VXLAN interface during switchd restart. The /var/log/switchd.log file includes the following exception logs shortly after switchd restarts:switchd[30158]: hal_bcm_l3.c:1617 find_egr_path_if_vxlan_overlay:vxlan overlay : nh PORT: port <#>, vlanMAC learning looks correct, but traffic does not flow as expected. |
3.7.0-4.3.1 | 4.3.2-4.4.5 |
| 3330705 |
When using TACACS+, a TACACS+ server name that returns more than one IP address, such as an IPv6 and IPv4 address, is counted many times against the limit of seven TACACS+ servers, which might cause some of the later listed servers to be ignored as over the limit. To work around this issue, you can set the prefer_ip_version configuration option (the default value is 4) to choose between an IPv4 or IPv6 address if both are present. |
3.7.0-5.3.1 | 5.4.0-5.15.0 |
| 3327477 |
If you use su to change to a user specified through TACACS+, the user becomes the local tacacs0 thru tacacs15 user instead of the named user to run sudo commands. As a result, the named user password might not match the local tacacs0 thru tacacs15 user password. |
3.7.0-3.7.16, 4.0.0-4.4.5, 5.0.0-5.15.0 | |
| 3216921 |
RADIUS authenticated users with read-only access to NCLU commands (users in the users_with_show list) can run edit commands if a username for a non-local account is on the users_with_edit line of the /etc/netd.conf file. To work around this issue, make sure that all usernames on the users_with_edit line of the /etc/netd.conf file are configured local users for the system (real Linux users) |
3.7.0-3.7.16, 4.3.0-4.4.5 | |
| 3209699 |
RADIUS authenticated users with read-only access to NCLU commands (users in the users_with_show list) can run edit commands if a username for a non-local account is on the users_with_edit line of the /etc/netd.conf file. To work around this issue, make sure that all usernames on the users_with_edit line of the /etc/netd.conf file are configured local users for the system (real Linux users) |
3.7.0-4.3.0, 4.4.0-5.2.1 | 4.3.1, 5.3.0-5.15.0 |
| 2546868 |
Broadcom Field Alert - SID - MMU 2B Errors A few of the MMU memories on Broadcom switches are grouped together with single parity control. During SER correction when a parity error occurs on one of those groups, other memory in that group might also report a SER error. This occurs when the memory is accessed either by a packet hit or through a schan operation. This issue can cause SER errors in other memory and cause traffic mis-forwarding or a packet drop. |
3.7.0-3.7.11, 4.0.0-4.0.1 | 3.7.12-3.7.16, 4.1.0-4.4.5 |
| 2546702 |
The FRR cl-support module times out on switches on the ARM platform even when the switch is not under heavy load. To work around this issue, run the cl-support -M command to disable timeouts. |
3.7.0-3.7.11, 4.0.0-4.0.1 | 3.7.12-3.7.16, 4.1.0-4.4.5 |
| 2543211 |
In some cases, the switchd service might warn of excessive MAC moves from one switch port to itself (for example, from swp18 to swp18). |
3.7.0-3.7.16, 4.0.0-4.4.5 | |
| 2540845 |
On the Dell Z9100-ON switch, smond reports various sensors going from OK to BAD or OK to ABSENT; then the sensors recover. |
3.7.1-3.7.5 | 3.7.6-3.7.16 |
| 2540557 |
On Trident3 switches, transit packets larger than 1500 bytes(DF) routed between SVIs is unexpectedly forwarded to the CPU even when the MTU is greater than 9000. This severely limits throughput for routed jumbo frames as packets arriving at a high interval are dropped to the CPU. | 3.7.0-3.7.16 | |
| 2539962 |
When an LDAP user that does not have NCLU privileges (either in the netshow or netedit group, or in the /etc/netd.conf file) runs an NCLU command, a traceback occurs instead of a permissions error. |
3.7.0-3.7.16, 4.0.0-4.4.5 | |
| 2539912 |
The snmpd service fails and generates a core file when the service is stopped or restarted and there is a trapsess line configured. To work around this issue, comment out the trapsess lines. |
3.7.0-3.7.1 | 3.7.2-3.7.16 |
| 2539433 |
If multiple files reference the same module, ifupdown2 user-defined policy overrides do not apply. | 3.7.0-3.7.6 | 3.7.7-3.7.16 |
| 2539081 |
When you delete post-up and pre-down IP peer entries from the etc/network/interfaces file, then run the ifreload command, the IP addresses are not removed and the route remains in the route table. To work around this issue, either delete the IP addresses without the /32 mask component or flush the IP addresses for the interface with the ip addr flush dev command. |
3.7.0-3.7.16 | 4.0.0-4.4.5 |
| 2538910 |
In a layer 2 VXLAN configuration, where each ECMP path is a layer 3 LACP bond with multiple port members, ECMP hash appears fine for data traffic over VXLAN from one VTEP to another, but the LACP hash is unbalanced. | 3.7.1-3.7.6 | 3.7.7-3.7.16 |
| 2538814 |
The permanent MAC entry that corresponds to the SVI of the layer 3 VNI (corresponding VLAN) is missing in the bridge FDB. | 3.7.0-3.7.16 | |
| 2538443 |
On the Dell S5048F and Dell Z9100 switches, the MODULE_DEVICE_TABLE declaration enables the kernel to auto load the drivers on any platform with a Xilinx 7021 device. As a result, these switches might exhibit errors in their dmseg logs when trying to auto load an incompatible driver. | 3.7.0-3.7.1 | 3.7.2-3.7.16 |
| 2538302 |
portwd allows an error to change the module type based on the error. For example, a bad write to a module might cause the module type to flap, which causes the link itself to flap. |
3.7.0-3.7.16 | |
| 2538294 |
If you use NCLU to create an iBGP peering across the peer link, running the net add bgp l2vpn evpn neighbor peerlink.4094 activate command creates a new eBGP neighborship when one has already been configured for iBGP. This is unexpected; the existing iBGP configuration is valid. |
3.7.0-3.7.16, 4.0.0-4.4.5 | |
| 2538206 |
You cannot currently disable FEC in Cumulus Linux on a Mellanox switch. | 3.7.1-3.7.3 | 3.7.4-3.7.16 |
| 2538054 |
On the Dell S4148 switch, if link pause is enabled in the /etc/cumulus/datapath/traffic.conf file, switchd fails to restart. |
3.7.0-3.7.3 | 3.7.4-3.7.16 |
| 2538013 |
When the peer link is lost and the backup IP address becomes inactive, the MLAG secondary switch brings up bonds but not VXLAN VNIs. | 3.7.1-3.7.3 | 3.7.4-3.7.16 |
| 2538004 |
Cumulus VX images for versions 3.7.0 through 3.7.2 include a vagrant user, as the vagrant box format [requires it|https://www.vagrantup.com/docs/boxes/base.html#default-user-settings] in order to function. This user is not needed; remove the user from the following Cumulus VX images: * cumulus-linux-3.7.0-vx-amd64-qemu.qcow2 * cumulus-linux-3.7.0-vx-amd64-vbox.ova * cumulus-linux-3.7.0-vx-amd64-vmware.ova * cumulus-linux-3.7.1-vx-amd64-qemu.qcow2 * cumulus-linux-3.7.1-vx-amd64-vbox.ova * cumulus-linux-3.7.1-vx-amd64-vmware.ova * cumulus-linux-3.7.2-vx-amd64-qemu.qcow2 * cumulus-linux-3.7.2-vx-amd64-vbox.ova * cumulus-linux-3.7.2-vx-amd64-vmware.ova To remove the vagrant user, run:
|
3.7.0-3.7.2 | 3.7.3-3.7.16 |
| 2537836 |
Running ifdown vlan or ip link set vlan down brings down a virtual interface but the interface always comes back up after you run the ifreload -a or net commit command. |
3.7.1-3.7.2 | 3.7.3-3.7.16 |
| 2537832 |
In an MLAG configuration, you might see the traceback AttributeError: ‘NoneType’ object has no attribute ‘replace’. |
3.7.1 | 3.7.2-3.7.16 |
| 2537805 |
When you configure an IPv6 only neighbor with NCLU without the peer-group command, then execute the same commands again, the BGP session is reset. For example, if you run the following commands:
Cumulus Linux removes the net commands and adds the following line to FRR (using v6only remote-as), which causes BGP to flap.
This issue does not occur if you add the peer-group command; for example:
. |
3.7.0-3.7.3 | 3.7.4-3.7.16 |
| 2537699 |
There is a limitation on the number of SVI interfaces you can specify as DHCP relay interfaces in the /etc/default/isc-dhcp-relay file. For example, 1500 SVI interfaces causes the dhcrelay service to exit without a core file and logs similar to the following are generated for the interfaces:
Eventually the dhcrelay service stops. |
3.7.1-3.7.16, 4.0.0-4.4.5 | |
| 2537641 |
On the Celestica RedstoneV switch, the hardware settings are incorrect on swp14 and swp22. | 3.7.0-3.7.2 | 3.7.3-3.7.16 |
| 2537544 |
When you run the mstpctl command, you might see the bridge-port state as blocking when it is actually disabled. You might see the same incorrect bridge-port state when other programs or tools use the output of mstpctl; for example, SNMP output from the BRIDGE-MIB. |
3.7.1-3.7.16, 4.0.0-4.4.5 | |
| 2537409 |
It is not currently possible to bring up some 10G LR interfaces on Mellanox switches as auto-negotiation is set to on in hardware. |
3.7.1-3.7.3 | 3.7.4-3.7.16 |
| 2537378 |
NCLU SNMPv3 user configuration (add, delete, modify) does not complete. Changes are made to the /etc/snmp/snmpd.conf file but the SNMPv3 user cache file /var/lib/snmp/snmpd.conf fails to update correctly and the configuration does not reflect in operation. To work around this issue, stop snmpd, remove the cache file, then restart snmpd. |
3.7.1-3.7.16 | |
| 2537111 |
The gshut community is not removed after you commit the configuration. |
3.7.0-3.7.3 | 3.7.4-3.7.16 |
| 2537104 |
When you try to stop hsflowd on the Trident II+ switch with the systemctl stop hsflowd command, the process hangs until you stop it with SIGKILL. |
3.7.1-3.7.16 | 4.0.0-4.4.5 |
| 2537085 |
When you run the net add (bond|interface) command, NCLU does not add the port as a slave of the VLAN-aware bridge. |
3.7.1-3.7.2 | 3.7.3-3.7.16 |
| 2537061 |
The Dell S5048F-ON switch (with reverse airflow, rear to front), shows the Temp-3 sensor as absent. |
3.7.1-4.0.1 | 4.1.0-4.4.5 |
| 2537038 |
When you run the NCLU net show system command on the Dell S5248F-ON switch, the output shows blank values for both CPU and Chipset:
|
3.7.0-3.7.1 | 3.7.2-3.7.16 |
| 2537028 |
Under certain conditions, DHCP relay produces a segmentation fault when used in an EVPN symmetric environment with the -U option. |
3.7.1 | 3.7.2-3.7.16 |
| 2536975 |
When you have certain options configured (such as PIM, MSDP, or ssmping), exit-vrf is copied beneath the vni line within the vrf stanza in the running vtysh configuration and in the /etc/frr/frr.conf file. This can cause a conflict; for example, if you are running PIM in the same VRF, the vni line is added above the ip pim rp line:
|
3.7.0-3.7.1 | 3.7.2-3.7.16 |
| 2536730 |
When you run the net show counters json command, you see the following error if any value is Unknown:
To work around this issue, run the following command to clear out the semaphore file created by cl-netstat -c:
|
3.7.0-3.7.2 | 3.7.3-3.7.16 |
| 2536686 |
If you add the MTU to a VLAN with the NCLU net add vlan command, Cumulus Linux adds extra mtu lines in the /etc/network/interfaces file when there are defined bridge ports that do not exist elsewhere in the file. |
3.7.0-3.7.1 | 3.7.2-3.7.16 |
| 2536669 |
After attempting to install unsupported ICMPv6-type rules, the hardware sync fails with an Out of table resource message even after you correct the rules. |
3.7.0-3.7.1 | 3.7.2-3.7.16 |
| 2536650 |
Mellanox Spectrum and Helix4 switches occasionally send malformed packets and do not send any flow samples (only counters). While this issue is fixed for switches with the Spectrum ASIC, this is a [known limitation|https://docs.cumulusnetworks.com/cumulus-linux/Monitoring-and-Troubleshooting/Network-Troubleshooting/Monitoring-System-Statistics-and-Network-Traffic-with-sFlow/#caveats-and-errata] on this Helix4 platform. |
3.7.0-3.7.8 | 3.7.9-3.7.16, 4.0.0-4.4.5 |
| 2536639 |
On a Dell S4048 switch, when you set the eth0 speed to 100, either with NCLU or by editing the /etc/network/interfaces file, the igb driver crashes, which brings down eth0. To work around this issue: * If eth0 is configured in the management VRF, power cycle the switch; the eth0 configuration fails and reverts back to the default (auto-negotiation/1000). * If eth0 is configured in the default VRF and you power cycle after the crash, igb continues to crash on boot up (before getting to login prompt); power-cycle the switch, select the Advanced option in GRUB to boot to recovery mode, then modify the /etc/network/interfaces file. |
3.7.0-3.7.16 | 4.0.0-4.4.5 |
| 2536615 |
NCLU net show configuration commands does not display any output for IPv6 rsyslog hosts. |
3.7.0-3.7.2 | 3.7.3-3.7.16 |
| 2536614 |
NCLU net show configuration commands displays a net add syslog command with invalid syntax. For example, if you run the following commands:
then run�� net show configuration commands, the output of the command syntax is invalid. |
3.7.0-3.7.2 | 3.7.3-3.7.16 |
| 2536608 |
Single tagged ARP requests received on a QinQ-over-VXLAN access port are dropped if ARP suppression is enabled on an unrelated VNI. |
3.7.0-3.7.16 | |
| 2536520 |
When you run the net show system command on a Facebook Backpack switch, you see an error in netd.log:
|
3.7.0-3.7.1 | 3.7.2-3.7.16 |
| 2536447 |
Add the DAS listener service to the /etc/vrf/systemd.conf file so it can be started in the management VRF as needed. |
3.7.0-3.7.1 | 3.7.2-3.7.16 |
| 2536384 |
The BFD packet redirection logic used by OVSDB server high availability mode redirects BUM packets across the peer link. The iptables rule for redirection does differentiate between BFD and non-BFD VXLAN inner packets because the service node sends all frames with its own IP address as the tunnel source IP address. The VXLAN encapsulated BUM packets do not get forwarded to the CPU and do not go through the iptable redirection rule; only VXLAN encapsulated BFD packets get forwarded to the CPU due to the inner MAC DA lookup in hardware. |
3.7.0-3.7.16, 4.0.0-4.4.5 | |
| 2536245 |
When using dynamic route leaking, software forwarding of packets fails between the connected source and destination. To work around this issue, configure the leak on a switch that does not have any locally-connected hosts. |
3.7.1-3.7.2 | 3.7.3-3.7.16 |
| 2536179 |
On switches with the Trident 2+ ASIC, counters associated with VLANs and VRFs are not working. | 3.7.0-3.7.16, 4.0.0-4.4.5 | |
| 2535986 |
At a high CPU transmit traffic rate (for example, if there is unexpected CPU generated flooding or replication in software), when the ASIC packet driver cannot keep up with the transmit rate because there are no free DMA buffers, it can back pressure by suspending the switch port transmit queues. This can fill up the application socket buffers resulting in No buffer space available error messages on protocol sockets.When the driver recovers, it automatically resumes the transmit queues. In most cases these error messages are transient. In rare cases, the hardware queues might get stuck, which you can recover with a switchd restart. |
3.7.0-3.7.16, 4.0.0-4.4.5 | |
| 2535965 |
On the Trident3 switch, static PIM with IIF based on a layer 2 bridge does not work reliably. PIM Join via signaling is required for IPMC to work properly. To work around this issue, use dynamic signaling (joins) to manage IP multicast traffic. |
3.7.0-3.7.16, 4.0.0-4.4.5 | |
| 2535751 |
The NCLU net add and net commit commands change the interfaces file even if you add a service like snmp/hostname/etc. This causes an issue with automation. For example, Ansible runs handlers (ifreload -a for interfaces) during each push if the file being edited changes. |
3.7.0-3.7.2 | 3.7.3-3.7.16 |
| 2534450 |
The default BGP instance must be provisioned and always exist for proper operation of dynamic leaking of routes between VRFs. | 3.7.0-3.7.16 | 4.0.0-4.4.5 |
| 2533039 |
Currently, Cumulus Linux does not program the remote network SVI IP address in the route table. As a result, you can’t ping the remote network gateway address; however, you can ping the hosts in that remote network. | 3.7.0-3.7.2 | 3.7.3-3.7.16 |
| 2532924 |
The NetQ agent is bundled with Cumulus VX 3.4.3 and later; however, the NetQ agent is not bundled with Cumulus Linux 3.4.3 and later. The NetQ agent has been removed from Cumulus VX 3.7.7. The NetQ agent will be bundled with Cumulus Linux in a future release. | 3.7.0-3.7.6 | 3.7.7-3.7.16 |
Fixed Issues in 3.7.1
| Issue ID | Description | Affects |
|---|---|---|
| 2540153 |
On a Mellanox switch, when you change the VRF membership of an interface with VRR enabled, the VRR MAC address is not properly programmed into hardware. To work around this issue, delete and recreate the interface using ifup and ifdown. |
3.7.0 |
| 2536685 |
OSPF6 fails to start on a fresh install of Cumulus Linux 3.7. | 3.7.0 |
| 2536561 |
Due to changes made to the BMC firmware, Cumulus Linux might be unable to read certain sensors correctly on the Dell S5248F Trident3 switch; for example, the CPU temperature might appear as absent. | 3.7.0 |
| 2536521 |
If you change the BGP aggregate addresses using NCLU and FRR is restarted, the configuration is accepted, but the routes do not appear in the BGP table. To work around this issue, manually change the BGP aggregate addresses in vtysh. |
|
| 2536476 |
When clagd is running and you add or modify the MLAG VXLAN anycast IP address on the loopback using NCLU or by editing the configuration file, the changes are not applied. You need to restart clagd manually for the changes to be applied. |
|
| 2536195 |
On the Trident3 switch, any packet received with TTL=1 and destined to the CPU is marked as dropped. | |
| 2536157 |
On Mellanox switches, member interfaces for Bond are not supported on ERSPAN. | |
| 2536138 |
If you start FRRouting and your configuration has a BGP IPv4 network statement that is the same as an aggregate-address statement, then the aggregate is not announced. For example, if you have the following FRR configuration:
Then that network is not advertised unless the 172.16.250.0/24 (exactly) is in the RIB. The issue does not happen if the network statement does not exactly match the aggregate-address statement (including super and subnets). To work around this issue, remove the matching network statement. |
|
| 2536014 |
On a Tomahawk switch with VXLAN-enabled VLANs, if the native VLAN on a port is changed, the GPORT associated with a MAC address in that VLAN is incorrect. | |
| 2535940 |
The VRF membership for a VRR interface fails to update. This issue does not affect SVI (non-v0) interfaces. To work round this issue, reboot the switch or remove the VRR IP address and reconfigure it. For example:
|
|
| 2534501 |
Routes that are learned from an EVPN cloud do not get summarized. Only routes that reside on, or are owned by, a switch get summarized. |
3.7.0 Release Notes
Open Issues in 3.7.0
| Issue ID | Description | Affects | Fixed |
|---|---|---|---|
| 3410952 |
If MLAG is configured but disconnected from an MLAG peer for an extended period of time (days or more), there is a long delay (up to a minute per day) before traffic forwarding stabilizes after the MLAG peer connection re-establishes. | 3.7.0-4.3.1 | 4.3.2-4.4.5, 5.5.0-5.15.0 |
| 3376798 |
On Broadcom switches, Cumulus Linux does not create the hardware bridging domain for a traditional bridge with a VXLAN interface during switchd restart. The /var/log/switchd.log file includes the following exception logs shortly after switchd restarts:switchd[30158]: hal_bcm_l3.c:1617 find_egr_path_if_vxlan_overlay:vxlan overlay : nh PORT: port <#>, vlanMAC learning looks correct, but traffic does not flow as expected. |
3.7.0-4.3.1 | 4.3.2-4.4.5 |
| 3330705 |
When using TACACS+, a TACACS+ server name that returns more than one IP address, such as an IPv6 and IPv4 address, is counted many times against the limit of seven TACACS+ servers, which might cause some of the later listed servers to be ignored as over the limit. To work around this issue, you can set the prefer_ip_version configuration option (the default value is 4) to choose between an IPv4 or IPv6 address if both are present. |
3.7.0-5.3.1 | 5.4.0-5.15.0 |
| 3327477 |
If you use su to change to a user specified through TACACS+, the user becomes the local tacacs0 thru tacacs15 user instead of the named user to run sudo commands. As a result, the named user password might not match the local tacacs0 thru tacacs15 user password. |
3.7.0-3.7.16, 4.0.0-4.4.5, 5.0.0-5.15.0 | |
| 3216921 |
RADIUS authenticated users with read-only access to NCLU commands (users in the users_with_show list) can run edit commands if a username for a non-local account is on the users_with_edit line of the /etc/netd.conf file. To work around this issue, make sure that all usernames on the users_with_edit line of the /etc/netd.conf file are configured local users for the system (real Linux users) |
3.7.0-3.7.16, 4.3.0-4.4.5 | |
| 3209699 |
RADIUS authenticated users with read-only access to NCLU commands (users in the users_with_show list) can run edit commands if a username for a non-local account is on the users_with_edit line of the /etc/netd.conf file. To work around this issue, make sure that all usernames on the users_with_edit line of the /etc/netd.conf file are configured local users for the system (real Linux users) |
3.7.0-4.3.0, 4.4.0-5.2.1 | 4.3.1, 5.3.0-5.15.0 |
| 2546868 |
Broadcom Field Alert - SID - MMU 2B Errors A few of the MMU memories on Broadcom switches are grouped together with single parity control. During SER correction when a parity error occurs on one of those groups, other memory in that group might also report a SER error. This occurs when the memory is accessed either by a packet hit or through a schan operation. This issue can cause SER errors in other memory and cause traffic mis-forwarding or a packet drop. |
3.7.0-3.7.11, 4.0.0-4.0.1 | 3.7.12-3.7.16, 4.1.0-4.4.5 |
| 2546702 |
The FRR cl-support module times out on switches on the ARM platform even when the switch is not under heavy load. To work around this issue, run the cl-support -M command to disable timeouts. |
3.7.0-3.7.11, 4.0.0-4.0.1 | 3.7.12-3.7.16, 4.1.0-4.4.5 |
| 2543211 |
In some cases, the switchd service might warn of excessive MAC moves from one switch port to itself (for example, from swp18 to swp18). |
3.7.0-3.7.16, 4.0.0-4.4.5 | |
| 2540557 |
On Trident3 switches, transit packets larger than 1500 bytes(DF) routed between SVIs is unexpectedly forwarded to the CPU even when the MTU is greater than 9000. This severely limits throughput for routed jumbo frames as packets arriving at a high interval are dropped to the CPU. | 3.7.0-3.7.16 | |
| 2540153 |
On a Mellanox switch, when you change the VRF membership of an interface with VRR enabled, the VRR MAC address is not properly programmed into hardware. To work around this issue, delete and recreate the interface using ifup and ifdown. |
3.7.0 | 3.7.1-3.7.16 |
| 2539962 |
When an LDAP user that does not have NCLU privileges (either in the netshow or netedit group, or in the /etc/netd.conf file) runs an NCLU command, a traceback occurs instead of a permissions error. |
3.7.0-3.7.16, 4.0.0-4.4.5 | |
| 2539912 |
The snmpd service fails and generates a core file when the service is stopped or restarted and there is a trapsess line configured. To work around this issue, comment out the trapsess lines. |
3.7.0-3.7.1 | 3.7.2-3.7.16 |
| 2539433 |
If multiple files reference the same module, ifupdown2 user-defined policy overrides do not apply. | 3.7.0-3.7.6 | 3.7.7-3.7.16 |
| 2539081 |
When you delete post-up and pre-down IP peer entries from the etc/network/interfaces file, then run the ifreload command, the IP addresses are not removed and the route remains in the route table. To work around this issue, either delete the IP addresses without the /32 mask component or flush the IP addresses for the interface with the ip addr flush dev command. |
3.7.0-3.7.16 | 4.0.0-4.4.5 |
| 2538814 |
The permanent MAC entry that corresponds to the SVI of the layer 3 VNI (corresponding VLAN) is missing in the bridge FDB. | 3.7.0-3.7.16 | |
| 2538443 |
On the Dell S5048F and Dell Z9100 switches, the MODULE_DEVICE_TABLE declaration enables the kernel to auto load the drivers on any platform with a Xilinx 7021 device. As a result, these switches might exhibit errors in their dmseg logs when trying to auto load an incompatible driver. | 3.7.0-3.7.1 | 3.7.2-3.7.16 |
| 2538302 |
portwd allows an error to change the module type based on the error. For example, a bad write to a module might cause the module type to flap, which causes the link itself to flap. |
3.7.0-3.7.16 | |
| 2538294 |
If you use NCLU to create an iBGP peering across the peer link, running the net add bgp l2vpn evpn neighbor peerlink.4094 activate command creates a new eBGP neighborship when one has already been configured for iBGP. This is unexpected; the existing iBGP configuration is valid. |
3.7.0-3.7.16, 4.0.0-4.4.5 | |
| 2538054 |
On the Dell S4148 switch, if link pause is enabled in the /etc/cumulus/datapath/traffic.conf file, switchd fails to restart. |
3.7.0-3.7.3 | 3.7.4-3.7.16 |
| 2538004 |
Cumulus VX images for versions 3.7.0 through 3.7.2 include a vagrant user, as the vagrant box format [requires it|https://www.vagrantup.com/docs/boxes/base.html#default-user-settings] in order to function. This user is not needed; remove the user from the following Cumulus VX images: * cumulus-linux-3.7.0-vx-amd64-qemu.qcow2 * cumulus-linux-3.7.0-vx-amd64-vbox.ova * cumulus-linux-3.7.0-vx-amd64-vmware.ova * cumulus-linux-3.7.1-vx-amd64-qemu.qcow2 * cumulus-linux-3.7.1-vx-amd64-vbox.ova * cumulus-linux-3.7.1-vx-amd64-vmware.ova * cumulus-linux-3.7.2-vx-amd64-qemu.qcow2 * cumulus-linux-3.7.2-vx-amd64-vbox.ova * cumulus-linux-3.7.2-vx-amd64-vmware.ova To remove the vagrant user, run:
|
3.7.0-3.7.2 | 3.7.3-3.7.16 |
| 2537805 |
When you configure an IPv6 only neighbor with NCLU without the peer-group command, then execute the same commands again, the BGP session is reset. For example, if you run the following commands:
Cumulus Linux removes the net commands and adds the following line to FRR (using v6only remote-as), which causes BGP to flap.
This issue does not occur if you add the peer-group command; for example:
. |
3.7.0-3.7.3 | 3.7.4-3.7.16 |
| 2537641 |
On the Celestica RedstoneV switch, the hardware settings are incorrect on swp14 and swp22. | 3.7.0-3.7.2 | 3.7.3-3.7.16 |
| 2537111 |
The gshut community is not removed after you commit the configuration. |
3.7.0-3.7.3 | 3.7.4-3.7.16 |
| 2537038 |
When you run the NCLU net show system command on the Dell S5248F-ON switch, the output shows blank values for both CPU and Chipset:
|
3.7.0-3.7.1 | 3.7.2-3.7.16 |
| 2536975 |
When you have certain options configured (such as PIM, MSDP, or ssmping), exit-vrf is copied beneath the vni line within the vrf stanza in the running vtysh configuration and in the /etc/frr/frr.conf file. This can cause a conflict; for example, if you are running PIM in the same VRF, the vni line is added above the ip pim rp line:
|
3.7.0-3.7.1 | 3.7.2-3.7.16 |
| 2536730 |
When you run the net show counters json command, you see the following error if any value is Unknown:
To work around this issue, run the following command to clear out the semaphore file created by cl-netstat -c:
|
3.7.0-3.7.2 | 3.7.3-3.7.16 |
| 2536686 |
If you add the MTU to a VLAN with the NCLU net add vlan command, Cumulus Linux adds extra mtu lines in the /etc/network/interfaces file when there are defined bridge ports that do not exist elsewhere in the file. |
3.7.0-3.7.1 | 3.7.2-3.7.16 |
| 2536685 |
OSPF6 fails to start on a fresh install of Cumulus Linux 3.7. | 3.7.0 | 3.7.1-3.7.16 |
| 2536669 |
After attempting to install unsupported ICMPv6-type rules, the hardware sync fails with an Out of table resource message even after you correct the rules. |
3.7.0-3.7.1 | 3.7.2-3.7.16 |
| 2536650 |
Mellanox Spectrum and Helix4 switches occasionally send malformed packets and do not send any flow samples (only counters). While this issue is fixed for switches with the Spectrum ASIC, this is a [known limitation|https://docs.cumulusnetworks.com/cumulus-linux/Monitoring-and-Troubleshooting/Network-Troubleshooting/Monitoring-System-Statistics-and-Network-Traffic-with-sFlow/#caveats-and-errata] on this Helix4 platform. |
3.7.0-3.7.8 | 3.7.9-3.7.16, 4.0.0-4.4.5 |
| 2536639 |
On a Dell S4048 switch, when you set the eth0 speed to 100, either with NCLU or by editing the /etc/network/interfaces file, the igb driver crashes, which brings down eth0. To work around this issue: * If eth0 is configured in the management VRF, power cycle the switch; the eth0 configuration fails and reverts back to the default (auto-negotiation/1000). * If eth0 is configured in the default VRF and you power cycle after the crash, igb continues to crash on boot up (before getting to login prompt); power-cycle the switch, select the Advanced option in GRUB to boot to recovery mode, then modify the /etc/network/interfaces file. |
3.7.0-3.7.16 | 4.0.0-4.4.5 |
| 2536615 |
NCLU net show configuration commands does not display any output for IPv6 rsyslog hosts. |
3.7.0-3.7.2 | 3.7.3-3.7.16 |
| 2536614 |
NCLU net show configuration commands displays a net add syslog command with invalid syntax. For example, if you run the following commands:
then run�� net show configuration commands, the output of the command syntax is invalid. |
3.7.0-3.7.2 | 3.7.3-3.7.16 |
| 2536608 |
Single tagged ARP requests received on a QinQ-over-VXLAN access port are dropped if ARP suppression is enabled on an unrelated VNI. |
3.7.0-3.7.16 | |
| 2536561 |
Due to changes made to the BMC firmware, Cumulus Linux might be unable to read certain sensors correctly on the Dell S5248F Trident3 switch; for example, the CPU temperature might appear as absent. | 3.7.0 | 3.7.1-3.7.16 |
| 2536520 |
When you run the net show system command on a Facebook Backpack switch, you see an error in netd.log:
|
3.7.0-3.7.1 | 3.7.2-3.7.16 |
| 2536447 |
Add the DAS listener service to the /etc/vrf/systemd.conf file so it can be started in the management VRF as needed. |
3.7.0-3.7.1 | 3.7.2-3.7.16 |
| 2536384 |
The BFD packet redirection logic used by OVSDB server high availability mode redirects BUM packets across the peer link. The iptables rule for redirection does differentiate between BFD and non-BFD VXLAN inner packets because the service node sends all frames with its own IP address as the tunnel source IP address. The VXLAN encapsulated BUM packets do not get forwarded to the CPU and do not go through the iptable redirection rule; only VXLAN encapsulated BFD packets get forwarded to the CPU due to the inner MAC DA lookup in hardware. |
3.7.0-3.7.16, 4.0.0-4.4.5 | |
| 2536179 |
On switches with the Trident 2+ ASIC, counters associated with VLANs and VRFs are not working. | 3.7.0-3.7.16, 4.0.0-4.4.5 | |
| 2535986 |
At a high CPU transmit traffic rate (for example, if there is unexpected CPU generated flooding or replication in software), when the ASIC packet driver cannot keep up with the transmit rate because there are no free DMA buffers, it can back pressure by suspending the switch port transmit queues. This can fill up the application socket buffers resulting in No buffer space available error messages on protocol sockets.When the driver recovers, it automatically resumes the transmit queues. In most cases these error messages are transient. In rare cases, the hardware queues might get stuck, which you can recover with a switchd restart. |
3.7.0-3.7.16, 4.0.0-4.4.5 | |
| 2535965 |
On the Trident3 switch, static PIM with IIF based on a layer 2 bridge does not work reliably. PIM Join via signaling is required for IPMC to work properly. To work around this issue, use dynamic signaling (joins) to manage IP multicast traffic. |
3.7.0-3.7.16, 4.0.0-4.4.5 | |
| 2535751 |
The NCLU net add and net commit commands change the interfaces file even if you add a service like snmp/hostname/etc. This causes an issue with automation. For example, Ansible runs handlers (ifreload -a for interfaces) during each push if the file being edited changes. |
3.7.0-3.7.2 | 3.7.3-3.7.16 |
| 2534450 |
The default BGP instance must be provisioned and always exist for proper operation of dynamic leaking of routes between VRFs. | 3.7.0-3.7.16 | 4.0.0-4.4.5 |
| 2533039 |
Currently, Cumulus Linux does not program the remote network SVI IP address in the route table. As a result, you can’t ping the remote network gateway address; however, you can ping the hosts in that remote network. | 3.7.0-3.7.2 | 3.7.3-3.7.16 |
| 2532924 |
The NetQ agent is bundled with Cumulus VX 3.4.3 and later; however, the NetQ agent is not bundled with Cumulus Linux 3.4.3 and later. The NetQ agent has been removed from Cumulus VX 3.7.7. The NetQ agent will be bundled with Cumulus Linux in a future release. | 3.7.0-3.7.6 | 3.7.7-3.7.16 |
Fixed Issues in 3.7.0
| Issue ID | Description | Affects |
|---|---|---|
| 2536324 |
When you use NCLU to add an SVI to the second MLAG peer (after adding to the first), clagd issues a traceback and becomes unresponsive until systemd puts it into a failed state. |
|
| 2536199 |
When you add a new SVI to the switch and assign it to an existing VRF, all IPv6 global unicast address (GUA) neighbors are flushed and existing traffic between hosts in the data center is dropped. | |
| 2536141 |
If you run ipdown and ifup commands several times on an SVI, you might see a clagd traceback. |
|
| 2536111 |
When the ptmd daemon detects an LLDP neighbor change event, the respective script is executed (if-topo-pass or if-topo-fail). Environment variables are set and are accessible to the script (as described in man ptmd). However, in LLDP events, some environment variables are not getting set correctly. |
|
| 2536096 |
If SNMP is configured, entering the NCLU command to create an SNMP v3 user that already exists returns an exit code of 1. To work around this issue, delete the username with the net del snmp-server username command before adding it again. |
|
| 2536069 |
The link-down yes configuration in the /etc/network/interfaces file does not work for eth0 or eth1 configured in the management VRF. This issue is not observed if the Ethernet interface is in the default VRF. |
|
| 2536041 |
When you start an Ansible playbook on an unlicensed Mellanox switch, a kernel fault occurs when setup script is being executed. | |
| 2536034 |
After a sequence of MAC moves and IP moves, the leaf switches behind which the host is present point to the old MAC address associated with that IP address. | |
| 2536011 |
When you run an NCLU command from the command line, the command hangs without a response. | |
| 2535951 |
If a bond is configured with NCLU, incorrect configuration is generated on the system so that when you run net show config commands, you see a message stating that the vid and pvid commands are not supported and incorrect commands are provided to configure them. |
|
| 2535939 |
When you add a new peer group, then change the AFIs associated with that peer group, the frr-reload script fails with the error Specify remote-as or peer-group commands first. To work around this issue, perform the configuration in two separate commits. First, create the peer groups and commit, then change the AFIs in a second commit. |
|
| 2535912 |
The BFD UDP source port range is incorrect. | |
| 2535873 |
An ML2 REST API call to add a host to the bridge fails with an error. | |
| 2535869 |
When you configure a breakout port using NCLU, the configuration is not successful. | |
| 2535841 |
When a BGP peer is created with max med on startup, a timer is created. Deleting the BGP instance that contains that peer during the window in which the timer is still running results in a BGPd crash. | |
| 2535774 |
For hosts (virtual machines) that rely on VRR, it is expected that the virtual-address is periodically sent by the gateway to avoid flooding on kvm/libvirt. Cumulus Linux sends GARP messages every 150 seconds out of the -v0 interface so the packet is not transmitted on the physical VLAN interface. |
|
| 2535744 |
NCLU mistakenly believes the FRR reload state is not active and restarts the service. | |
| 2535742 |
Whenever there is a netlink link event, mstpd prints an additional log: bridge_notify: port 65: no_flush 0 where 65 is the ifIndex. There are already clear logs when there is a link transition; this log is not necessary. |
|
| 2535720 |
If you change the IP address of the clagd-backup-ip parameter in the configuration file and run ifreload -a, the changes are not applied and the VRF configuration is removed. |
|
| 2535705 |
On a Broadcom Trident II+ switch, VXLAN decapsulation does not work for unknown unicast flooding. To work around this issue, disable VXLAN routing by editing the /usr/lib/python2.7/dist-packages/cumulus/__chip_config/bcm/datapath.conf file; change the vxlan_routing_overlay.profile variable to disable, then restart switchd. |
|
| 2535637 |
If there is a failure when NCLU runs frr-reload.py, an incorrect error code of 0 is returned. |
|
| 2535630 |
The Dell S5048 Tomahawk+ ASIC does not provide high power to QSFP. | |
| 2535502 |
If you change the ASN configuration on a switch running EVPN then reload the FRR service (using sudo systemctl reload frr or via net commit), the programming of VXLAN forwarding entries breaks. To avoid this issue when making this change, restart the FRR process (using sudo systemctl restart frr) instead. |
|
| 2535420 |
When running the openstack network create command, you see an internal server error. |
|
| 2535087 |
When you use the net del all command in a configuration that is run by an Ansible script, the peerlink.4094 interface remains in the configuration, which prevents the commit from completing because the configured MTU is not accepted. |
|
| 2534865 |
On Maverick 100G switches, after enabling FEC on links with 100G AOC cables, random links do not come up after a reboot. To work around this issue, disable FEC on 100G AOC links. | |
| 2534556 |
After moving an IP address to a new host, the neighbor table and EVPN routes do not update properly after receiving a GARP from the new MAC address to which the previously-active IP address has been moved. This issue is being investigated at this time. | |
| 2534230 |
On a Cumulus Linux switch, if a bridge has VXLAN interfaces, then the arp_accept and arp_ignore options do not work for any switch virtual interfaces (SVIs). To work around this issue, disable ARP suppression on the VXLAN interfaces. For example, if the VXLAN is named vni100, disable ARP suppression on it with the following command:
This issue should be fixed in a future release of Cumulus Linux. |
|
| 2534087 |
In a VXLAN centralized routing configuration, IPv6 hosts (auto-configured using SLAAC) might experience intermittent connectivity loss between VXLAN segments (inter-subnet routing) within the data center fabric (EVPN type-5 external routes are not affected). The NA message has the wrong flag set (the router flag is not set, which is incorrect behavior based on RFC 4861, Section 4.4). To work around this issue, configure bridge-arp-nd-suppress off under VNI interfaces for all VTEP devices. |
|
| 2533775 |
The Edgecore AS4610-54T switch always displays a yellow system LED. | |
| 2527924 |
When adding applying an anycast IP address in a VXLAN configuration to a pair of switches, the clagd process stops. |
|
| 2527444 |
On a Broadcom switch the HwIfOutQlen NIC statistic shows an incorrect value. |