Skip to content

issue NewValidation: CSCwq28721 #358

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
jeestr4d wants to merge 1 commit into
base: v4.2.0-dev
Choose a base branch
from
Open

issue NewValidation: CSCwq28721 #358

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
36 changes: 36 additions & 0 deletions aci-preupgrade-validation-script.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6025,6 +6025,41 @@ def apic_downgrade_compat_warning_check(cversion, tversion, **kwargs):

return Result(result=result, headers=headers, data=data, recommended_action=recommended_action, doc_url=doc_url)

@check_wrapper(check_title="NTP Server BD SVI Check")
def ntp_server_bd_svi_check(cversion, tversion, **kargs):
result = FAIL_UF

@monrog2 monrog2 Jul 23, 2026

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[Blocking] Use outage severity. CSCwp92030 causes loss of NTP service after the upgrade; it does not prevent the upgrade itself. Please use FAIL_O rather than FAIL_UF so result summaries and customer guidance represent the risk correctly, and update the positive test expectation.

headers = ["Fabric Time Pol", "NTP Pol Name"]
data = []
recommended_action = 'Use the in-band or out-of-band management IP address of the leaf switch as the NTP server IP address.'
doc_url = "https://datacenter.github.io/ACI-Pre-Upgrade-Validation-Script/validations/#ntp-server-bd-svi"

if not tversion:
return Result(result=MANUAL, msg=TVER_MISSING)

if cversion.older_than("6.1(1f)") or cversion.newer_than("6.1(5e)"):

@monrog2 monrog2 Jul 23, 2026

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[Blocking] Vulnerable target upgrades are skipped. Requiring the current version to already be within 6.1(1f)-6.1(5e) makes an upgrade such as 6.0(9f) -> 6.1(1f) return N/A, even though the destination is affected. Gate applicability on the authoritative target-version range (and any actual upgrade-path constraints), and add a crossing-boundary test.

return Result(result=NA, msg='Version not affected')

if tversion.older_than("6.1(1f)") or tversion.newer_than("6.1(5e)"):
return Result(result=NA, msg='Version not affected')

fabric_time_pols = icurl('class', 'fabricRsTimePol.json')
datetime_pols = icurl('class', 'datetimePol.json')

fabric_time_pol_regex = r'uni/fabric/funcprof/podpgrp-(?P<podgroup>[^/]+)/rsTimePol'
for datetime_pol in datetime_pols:
for fabric_time_pol in fabric_time_pols:
if (

@monrog2 monrog2 Jul 23, 2026

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[High] Validate the complete defect trigger. The CSCwp92030 conditions require multiple BDs/IPs in the relevant VRF, but this logic flags every enabled leaf NTP-server policy without examining BD/VRF topology. That produces outage failures where the documented trigger is absent. Please detect the complete condition, or reconcile the intended scope and documentation with the canonical defect before failing the check.

datetime_pol['datetimePol']['attributes']['dn'] == fabric_time_pol['fabricRsTimePol']['attributes']['tDn']
) and(
datetime_pol['datetimePol']['attributes']['serverState'] == 'enabled'
):
fp = re.search(fabric_time_pol_regex, fabric_time_pol['fabricRsTimePol']['attributes']['dn'])
data.append([fp.group("podgroup"), datetime_pol['datetimePol']['attributes']['name']])

if not data:

@monrog2 monrog2 Jul 23, 2026

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[High] Do not turn missing required inventory into PASS. If the datetimePol query unexpectedly returns no objects, data remains empty and this reports success even though APIC should at least have the default policy. Validate the required inventory separately and return ERROR for an incomplete response; retain PASS for a valid inventory with no enabled matching policy. Add an empty-datetimePol test.

result = PASS
return Result(result=result, headers=headers, data=data, recommended_action=recommended_action, doc_url=doc_url)


# ---- Script Execution ----

Expand Down Expand Up @@ -6188,6 +6223,7 @@ class CheckManager:
standby_sup_sync_check,
isis_database_byte_check,
configpush_shard_check,
ntp_server_bd_svi_check,

]
ssh_checks = [
Expand Down
13 changes: 13 additions & 0 deletions docs/docs/validations.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -193,6 +193,8 @@ Items | Defect | This Script
[Stale pconsRA Object][d26] | CSCwp22212 | :warning:{title="Deprecated"} | :no_entry_sign:
[ISIS DTEPs Byte Size][d27] | CSCwp15375 | :white_check_mark: | :no_entry_sign:
[Policydist configpushShardCont Crash][d28] | CSCwp95515 | :white_check_mark: |
[NTP Server BD SVI][d25] | CSCwp92030 | :white_check_mark: | :no_entry_sign:

@monrog2 monrog2 Jul 23, 2026

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[Medium] This row links to the wrong validation. [d25] resolves to #observer-database-size; the NTP anchor added below is [d29]. Please change this reference to [d29].



[d1]: #ep-announce-compatibility
[d2]: #eventmgr-db-size-defect-susceptibility
Expand Down Expand Up @@ -222,6 +224,7 @@ Items | Defect | This Script
[d26]: #stale-pconsra-object
[d27]: #isis-dteps-byte-size
[d28]: #policydist-configpushshardcont-crash
[d29]: #ntp-server-bd-svi


## General Check Details
Expand Down Expand Up @@ -2648,6 +2651,15 @@ Due to [CSCwp95515][59], upgrading to an affected version while having any `conf
If any instances of `configpushShardCont` are flagged by this script, Cisco TAC must be contacted to identify and resolve the underlying issue before performing the upgrade.


#### NTP Server BD SVI

In ACI, Leaf Switches can be configured as NTP servers, allowing Endpoints in ACI to act as NTP clients and sync their datetime with the Fabric. The Leaf switch uses it's BD SVI IP address to send NTP traffic.

Due to [CSCwp92030][62], after a policy upgrade NTP can stop working between Endpoint clients and NTP Server (ACI Leaf), Client reach the NTP server by it's BD SVI IP address, but the server replies on a Loopback address.

If you see the check alerting about Datetime Policies, apply the workaround to prevent NTP issues post-upgrade.


[0]: https://github.com/datacenter/ACI-Pre-Upgrade-Validation-Script
[1]: https://www.cisco.com/c/dam/en/us/td/docs/Website/datacenter/apicmatrix/index.html
[2]: https://www.cisco.com/c/en/us/support/switches/nexus-9000-series-switches/products-release-notes-list.html
Expand Down Expand Up @@ -2710,3 +2722,4 @@ If any instances of `configpushShardCont` are flagged by this script, Cisco TAC
[59]: https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwp95515
[60]: https://www.cisco.com/c/en/us/solutions/collateral/data-center-virtualization/application-centric-infrastructure/white-paper-c11-743951.html#Inter
[61]: https://www.cisco.com/c/en/us/solutions/collateral/data-center-virtualization/application-centric-infrastructure/white-paper-c11-743951.html#EnablePolicyCompression
[62]: https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwp92030
86 changes: 86 additions & 0 deletions tests/checks/ntp_server_bd_svi_check/datetimePol-neg.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,86 @@
[
{
"datetimePol": {
"attributes": {
"StratumValue": "8",
"adminSt": "disabled",
"annotation": "",
"authSt": "disabled",
"childAction": "",
"configIssues": "",
"descr": "",
"dn": "uni/fabric/time-default",
"extMngdBy": "",
"lcOwn": "local",
"masterMode": "disabled",
"modTs": "2026-02-03T15:12:35.361-06:00",
"monPolDn": "uni/fabric/monfab-default",
"name": "default",
"nameAlias": "",
"ownerKey": "",
"ownerTag": "",
"rn": "time-default",
"serverState": "disabled",
"status": "",
"uid": "0",
"userdom": ""
}
}
},
{
"datetimePol": {
"attributes": {
"StratumValue": "8",
"adminSt": "enabled",
"annotation": "",
"authSt": "disabled",
"childAction": "",
"configIssues": "",
"descr": "NTP for fabric in Vercruz",
"dn": "uni/fabric/time-fabric_ntp",
"extMngdBy": "",
"lcOwn": "local",
"masterMode": "disabled",
"modTs": "2026-02-03T15:12:35.361-06:00",
"monPolDn": "uni/fabric/monfab-default",
"name": "fabric_ntp",
"nameAlias": "",
"ownerKey": "",
"ownerTag": "",
"rn": "time-fabric_ntp",
"serverState": "disabled",
"status": "",
"uid": "23653",
"userdom": ""
}
}
},
{
"datetimePol": {
"attributes": {
"StratumValue": "8",
"adminSt": "enabled",
"annotation": "",
"authSt": "disabled",
"childAction": "",
"configIssues": "",
"descr": "",
"dn": "uni/fabric/time-calo-NTP",
"extMngdBy": "",
"lcOwn": "local",
"masterMode": "disabled",
"modTs": "2023-01-02T10:36:19.837-06:00",
"monPolDn": "uni/fabric/monfab-default",
"name": "calo-NTP",
"nameAlias": "",
"ownerKey": "",
"ownerTag": "",
"rn": "time-calo-NTP",
"serverState": "disabled",
"status": "",
"uid": "15374",
"userdom": ":all:"
}
}
}
]
86 changes: 86 additions & 0 deletions tests/checks/ntp_server_bd_svi_check/datetimePol-pos.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,86 @@
[
{
"datetimePol": {
"attributes": {
"StratumValue": "8",
"adminSt": "disabled",
"annotation": "",
"authSt": "disabled",
"childAction": "",
"configIssues": "",
"descr": "",
"dn": "uni/fabric/time-default",
"extMngdBy": "",
"lcOwn": "local",
"masterMode": "disabled",
"modTs": "2026-02-03T15:12:35.361-06:00",
"monPolDn": "uni/fabric/monfab-default",
"name": "default",
"nameAlias": "",
"ownerKey": "",
"ownerTag": "",
"rn": "time-default",
"serverState": "disabled",
"status": "",
"uid": "0",
"userdom": ""
}
}
},
{
"datetimePol": {
"attributes": {
"StratumValue": "8",
"adminSt": "enabled",
"annotation": "",
"authSt": "disabled",
"childAction": "",
"configIssues": "",
"descr": "NTP for fabric in Vercruz",
"dn": "uni/fabric/time-fabric_ntp",
"extMngdBy": "",
"lcOwn": "local",
"masterMode": "disabled",
"modTs": "2026-02-03T15:12:35.361-06:00",
"monPolDn": "uni/fabric/monfab-default",
"name": "fabric_ntp",
"nameAlias": "",
"ownerKey": "",
"ownerTag": "",
"rn": "time-fabric_ntp",
"serverState": "enabled",
"status": "",
"uid": "23653",
"userdom": ""
}
}
},
{
"datetimePol": {
"attributes": {
"StratumValue": "8",
"adminSt": "enabled",
"annotation": "",
"authSt": "disabled",
"childAction": "",
"configIssues": "",
"descr": "",
"dn": "uni/fabric/time-calo-NTP",
"extMngdBy": "",
"lcOwn": "local",
"masterMode": "disabled",
"modTs": "2023-01-02T10:36:19.837-06:00",
"monPolDn": "uni/fabric/monfab-default",
"name": "calo-NTP",
"nameAlias": "",
"ownerKey": "",
"ownerTag": "",
"rn": "time-calo-NTP",
"serverState": "disabled",
"status": "",
"uid": "15374",
"userdom": ":all:"
}
}
}
]
56 changes: 56 additions & 0 deletions tests/checks/ntp_server_bd_svi_check/fabricRsTimePol.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,56 @@
[
{
"fabricRsTimePol": {
"attributes": {
"annotation": "",
"childAction": "",
"dn": "uni/fabric/funcprof/podpgrp-calo-d-polGrp/rsTimePol",
"extMngdBy": "",
"forceResolve": "yes",
"lcOwn": "local",
"modTs": "2023-01-02T10:36:41.882-06:00",
"monPolDn": "uni/fabric/monfab-default",
"rType": "mo",
"rn": "rsTimePol",
"state": "formed",
"stateQual": "none",
"status": "",
"tCl": "datetimePol",
"tContextDn": "",
"tDn": "uni/fabric/time-calo-NTP",
"tRn": "time-calo-NTP",
"tType": "name",
"tnDatetimePolName": "calo-NTP",
"uid": "0",
"userdom": "all"
}
}
},
{
"fabricRsTimePol": {
"attributes": {
"annotation": "",
"childAction": "",
"dn": "uni/fabric/funcprof/podpgrp-PodPolicy-Fabric/rsTimePol",
"extMngdBy": "",
"forceResolve": "yes",
"lcOwn": "local",
"modTs": "2026-02-03T15:12:35.361-06:00",
"monPolDn": "uni/fabric/monfab-default",
"rType": "mo",
"rn": "rsTimePol",
"state": "formed",
"stateQual": "none",
"status": "",
"tCl": "datetimePol",
"tContextDn": "",
"tDn": "uni/fabric/time-fabric_ntp",
"tRn": "time-fabric_ntp",
"tType": "name",
"tnDatetimePolName": "fabric_ntp",
"uid": "0",
"userdom": ""
}
}
}
]
Loading