Added validation check for CSCwt58626

aci-preupgrade-validation-script.py

@@ -22,7 +22,7 @@
 from textwrap import TextWrapper
 from getpass import getpass
 from collections import defaultdict, OrderedDict
-from datetime import datetime
+from datetime import datetime, timedelta
 from argparse import ArgumentParser
 from itertools import chain
 import threading
@@ -6293,6 +6293,9 @@ def is_affected_target(ver):
         in_61 = ver.newer_than("6.1(1a)") and ver.older_than("6.1(4h)")
         return in_60 or in_61
 
+    if not tversion or not cversion:
+        return Result(result=MANUAL, msg=TVER_MISSING)
+
     pre_apic_upg = is_affected_source(cversion) and is_affected_target(tversion)  # Before APIC upgrade
     post_apic_upg = is_affected_target(cversion) and is_affected_target(tversion) and cversion.same_as(tversion)  # After APIC upgrade (and before switch)
 
@@ -6477,6 +6480,9 @@ def inband_management_policy_misconfig_check(cversion, tversion, **kwargs):
     recommended_action = "Contact Cisco TAC to remove any identified misconfigured 'mgmtRsInBStNode' objects"
     doc_url = "https://datacenter.github.io/ACI-Pre-Upgrade-Validation-Script/validations/#inband-management-policy-misconfiguration"
 
+    if not tversion or not cversion:
+        return Result(result=MANUAL, msg=TVER_MISSING)
+
     if (cversion.older_than("5.2(8d)")) and (tversion.newer_than("6.0(4c)") or tversion.same_as("6.0(4c)")):
         mgmtRsInBStNodes = icurl('class', 'mgmtRsInBStNode.json?query-target-filter=and(or(eq(mgmtRsInBStNode.addr,"0.0.0.0"),eq(mgmtRsInBStNode.gw,"0.0.0.0")),or(eq(mgmtRsInBStNode.v6Addr,"::"),eq(mgmtRsInBStNode.v6Gw,"::")))')
         for mgmtRsInBStNode in mgmtRsInBStNodes:
@@ -6685,7 +6691,12 @@ def stale_dbgacEpgSummaryTask_check(tversion, **kwargs):
     if tversion and ((tversion.major1 == "6" and tversion.major2 == "1" and tversion.newer_than("6.1(5e)")) or tversion.newer_than("6.2(1g)")):
         return Result(result=NA, msg=VER_NOT_AFFECTED, doc_url=doc_url)
 
-    threshold = datetime.utcnow() - timedelta(hours=24)
+    try:
+        from datetime import timezone 
+        threshold = datetime.now(timezone.utc).replace(tzinfo=None) - timedelta(hours=24) 
+    except ImportError:
+        threshold = datetime.utcnow() - timedelta(hours=24) 
+
     for obj in icurl("class", 'dbgacEpgSummaryTask.json?query-target-filter=eq(dbgacEpgSummaryTask.operSt,"processing")'):
         attr = obj["dbgacEpgSummaryTask"]["attributes"]
         dn = attr.get("dn", "")
@@ -6702,6 +6713,81 @@ def stale_dbgacEpgSummaryTask_check(tversion, **kwargs):
     return Result(result=result, headers=headers, data=data, recommended_action=recommended_action, doc_url=doc_url)
 
 
+@check_wrapper(check_title="InfraVLAN Overlap in Access Policy VLAN Pools")
+def infravlan_overlap_access_policy_check(tversion, **kwargs):
+    result = FAIL_UF
+    msg = ""
+    headers = ["InfraVLAN", "Encap Block", "VLAN Pool DN"]
+    unformatted_headers = ["InfraVLAN", "Encap Block", "VLAN Pool DN"]
+
+    data = []
+    unformatted_data = []
+    recommended_action = "Remove InfraVLAN from VLAN pool block highligted or upgrade to fix version"
+
+    doc_url = "https://datacenter.github.io/ACI-Pre-Upgrade-Validation-Script/validations/#infravlan-overlap-access-policy-check"
+
+    if not tversion:
+        return Result(result=MANUAL, msg=TVER_MISSING)
+
+    if not (tversion.same_as("6.2(1g)") or (
+        not tversion.older_than("6.1(3f)") and not tversion.newer_than("6.1(5e)")
+    )):
+        return Result(result=NA, msg=VER_NOT_AFFECTED)
+
+    dn_regex1 = r'uni/infra/vlanns-\[.+\]-(static|dynamic)/from-\[vlan-\d+\]-to-\[vlan-\d+\]'
+
+    dn_regex2 = r'uni/vmmp-[^/]+/dom-[^/]+/.+/from-\[vlan-\d+\]-to-\[vlan-\d+\]'
+
+    infra_vlan = None
+    has_error = False
+    lldpInsts = icurl('class', 'lldpInst.json?query-target-filter=wcard(lldpInst.dn,"/node-1/")')
+    for lldpInst in lldpInsts:
+        infra_vlan_id = lldpInst.get('lldpInst', {}).get('attributes', {}).get('infraVlan')
+        if not infra_vlan_id:
+            continue
+        match = re.search(r'\d+', str(infra_vlan_id))
+        if match:
+            infra_vlan = int(match.group(0))
+            break
+
+    if infra_vlan is None:
+        return Result(result=ERROR, msg="Unable to determine InfraVLAN from lldpInst.")
+
+    encap_blocks = icurl('class', 'fvnsEncapBlk.json?query-target-filter=eq(fvnsEncapBlk.role,"external")')
+    for obj in encap_blocks:
+        blk_attr = obj.get('fvnsEncapBlk', {}).get('attributes', {})
+        dn = blk_attr.get('dn', '')
+        from_encap = blk_attr.get('from')
+        to_encap = blk_attr.get('to')
+
+        if not dn or not from_encap or not to_encap:
+            has_error = True
+            continue
+
+        try:
+            from_vlan = int(str(from_encap).split('-')[-1])
+            to_vlan = int(str(to_encap).split('-')[-1])
+        except (ValueError, TypeError):
+            has_error = True
+            continue
+
+        if min(from_vlan, to_vlan) <= infra_vlan <= max(from_vlan, to_vlan):
+            row = [str(infra_vlan), "{} to {}".format(from_encap, to_encap), dn]
+            if re.search(dn_regex1, dn) or re.search(dn_regex2, dn):
+                data.append(row)
+            else:
+                unformatted_data.append(row)
+
+    if not data and not unformatted_data:
+        result = PASS
+        if has_error:
+            result = ERROR
+            msg = "Overlap check for InfraVLAN {} could not be determined because one or more VLAN pool blocks contain improper data or Error while fetching data.".format(infra_vlan)
+
+
+    return Result(result=result, msg=msg, headers=headers, data=data, unformatted_headers=unformatted_headers, unformatted_data=unformatted_data, recommended_action=recommended_action, doc_url=doc_url)
+
+
 # ---- Script Execution ----
 
 
@@ -6877,7 +6963,8 @@ class CheckManager:
         wred_affected_model_check,
         n9k_c93180yc_fx3_switch_memory_check,
         stale_dbgacEpgSummaryTask_check,
-
+        infravlan_overlap_access_policy_check,
+
     ]
     ssh_checks = [
         # General

docs/docs/validations.md

@@ -206,6 +206,7 @@ Items                                           | Defect       | This Script
 [WRED with Affected FM Models][d35]             | CSCwt50713   | :white_check_mark: | :no_entry_sign:
 [N9K-C93180YC-FX3 Switch Memory Less Than 32GB][d36] | CSCwm42741   | :white_check_mark: | :no_entry_sign:
 [Stale dbgacEpgSummaryTask Objects][d37]         | CSCwt69100   | :white_check_mark: | :no_entry_sign:
+[InfraVLAN Overlap in Access Policy VLAN Pools][d38] | CSCwt58626   | :white_check_mark: | :no_entry_sign:
 
 [d1]: #ep-announce-compatibility
 [d2]: #eventmgr-db-size-defect-susceptibility
@@ -244,6 +245,7 @@ Items                                           | Defect       | This Script
 [d35]: #wred-with-affected-fm-models
 [d36]: #n9k-c93180yc-fx3-switch-memory-less-than-32gb
 [d37]: #stale-dbgacepgsummarytask-objects
+[d38]: #infravlan-overlap-access-policy-check
 
 ## General Check Details
 
@@ -2846,6 +2848,12 @@ Affected versions: 6.1(5e) and below, or 6.2(1g).
 Contact Cisco TAC for next steps. For more details, refer to the workaround in [CSCwt69100][75].
 
 
+### Infravlan Overlap Access Policy Check
+
+Due to the bug [CSCwt58626][77] , If Apic upgrade planned for target versions 6.1(3f), 6.1(3g), 6.1(4h), 6.1(5e) and 6.2(1g), be aware of fault F4701 being raised if the InfraVLAN overlaps with any user-configured VLAN pool in Access Policies. This also affects vlan pool created by NDO/MSO, VMM, Kubernetes. After the upgrade, domains associated with those VLAN pools cannot be linked to new EPGs, although existing EPGs continue to function.
+
+To avoid this issue, modify the user VLAN pool ranges so that the InfraVLAN does not overlap with any configured block, or select a non-impacted fixed version. After upgrading to a fixed version this fault and Restriction have been removed.
+
 [0]: https://github.com/datacenter/ACI-Pre-Upgrade-Validation-Script
 [1]: https://www.cisco.com/c/dam/en/us/td/docs/Website/datacenter/apicmatrix/index.html
 [2]: https://www.cisco.com/c/en/us/support/switches/nexus-9000-series-switches/products-release-notes-list.html
@@ -2923,4 +2931,4 @@ Contact Cisco TAC for next steps. For more details, refer to the workaround in [
 [74]: https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwm42741
 [75]: https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwt69100
 [76]: https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwt38698
-
+[77]: https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwt58626

tests/checks/inband_management_policy_misconfig_check/test_inband_management_policy_misconfig_check.py

@@ -13,6 +13,13 @@
 @pytest.mark.parametrize(
     "icurl_outputs, cversion, tversion, expected_result, expected_data",
     [
+
+        # tversion missing
+        ({}, "5.2(7g)", None, script.MANUAL, []),
+        # cversion missing
+        ({}, None, "5.2(7g)", script.MANUAL, []),
+        # cversion and tversion missing
+        ({}, None, None, script.MANUAL, []),
         # Current version is affected, Target version = 6.0(4c), valid data
         (
             {
@@ -158,6 +165,9 @@
     ],
 )
 def test_logic(run_check, mock_icurl, cversion, tversion, expected_result, expected_data):
-    result = run_check(cversion=script.AciVersion(cversion), tversion=script.AciVersion(tversion))
+    result = run_check(
+        cversion=script.AciVersion(cversion) if cversion else None,
+        tversion=script.AciVersion(tversion) if tversion else None,
+    )
     assert result.result == expected_result
     assert result.data == expected_data

tests/checks/infravlan_overlap_access_policy_check/fvnsEncapBlk_empty.json

@@ -0,0 +1 @@
+[]

tests/checks/infravlan_overlap_access_policy_check/fvnsEncapBlk_missing_attrs_with_non_overlap_vlan_pool.json

@@ -0,0 +1,39 @@
+[
+  {
+    "fvnsEncapBlk": {
+      "attributes": {
+        "allocMode": "static",
+        "annotation": "orchestrator:aci-containers-controller",
+        "rn": "from-[vlan-3000]-to-[vlan-4094]",
+        "role": "external",
+        "from": "vlan-3000",
+        "to": "vlan-4094"
+      }
+    }
+  },
+  {
+    "fvnsEncapBlk": {
+      "attributes": {
+        "allocMode": "static",
+        "annotation": "orchestrator:aci-containers-controller",
+        "rn": "from-[vlan-3001]-to-[vlan-4094]",
+        "role": "external",
+        "from": "",
+        "to": "vlan-4094"
+      }
+    }
+  },
+  {
+    "fvnsEncapBlk": {
+      "attributes": {
+        "allocMode": "static",
+        "annotation": "orchestrator:aci-containers-controller",
+        "rn": "from-[vlan-10]-to-[vlan-20]",
+        "role": "external",
+        "from": "vlan-10",
+        "to": "vlan-20",
+        "dn": "uni/infra/vlanns-[vlan_pool3]-static/from-[vlan-10]-to-[vlan-20]"
+      }
+    }
+  }
+]

tests/checks/infravlan_overlap_access_policy_check/fvnsEncapBlk_missing_attrs_with_overlap_vlan_pool.json

@@ -0,0 +1,39 @@
+[
+  {
+    "fvnsEncapBlk": {
+      "attributes": {
+        "allocMode": "static",
+        "annotation": "orchestrator:aci-containers-controller",
+        "rn": "from-[vlan-3000]-to-[vlan-4094]",
+        "role": "external",
+        "from": "vlan-3000",
+        "to": "vlan-4094"
+      }
+    }
+  },
+  {
+    "fvnsEncapBlk": {
+      "attributes": {
+        "allocMode": "static",
+        "annotation": "orchestrator:aci-containers-controller",
+        "rn": "from-[vlan-3001]-to-[vlan-4094]",
+        "role": "external",
+        "from": "",
+        "to": "vlan-4094"
+      }
+    }
+  },
+  {
+    "fvnsEncapBlk": {
+      "attributes": {
+        "allocMode": "static",
+        "annotation": "orchestrator:aci-containers-controller",
+        "rn": "from-[vlan-4000]-to-[vlan-4094]",
+        "role": "external",
+        "from": "vlan-4000",
+        "to": "vlan-4094",
+        "dn": "uni/infra/vlanns-[vlan_pool3]-static/from-[vlan-4000]-to-[vlan-4094]"
+      }
+    }
+  }
+]

tests/checks/infravlan_overlap_access_policy_check/fvnsEncapBlk_no_overlap.json

@@ -0,0 +1,28 @@
+[
+  {
+    "fvnsEncapBlk": {
+      "attributes": {
+        "allocMode": "static",
+        "annotation": "orchestrator:aci-containers-controller",
+        "rn": "from-[vlan-200]-to-[vlan-300]",
+        "role": "external",
+        "from": "vlan-200",
+        "to": "vlan-300",
+        "dn": "uni/infra/vlanns-[vlan_pool1]-static/from-[vlan-200]-to-[vlan-300]"
+      }
+    }
+  },
+  {
+    "fvnsEncapBlk": {
+      "attributes": {
+        "allocMode": "static",
+        "annotation": "orchestrator:aci-containers-controller",
+        "rn": "from-[vlan-500]-to-[vlan-1000]",
+        "role": "external",
+        "from": "vlan-500",
+        "to": "vlan-1000",
+        "dn": "uni/infra/vlanns-[vlan_pool2]-static/from-[vlan-500]-to-[vlan-1000]"
+      }
+    }
+  }
+]

tests/checks/infravlan_overlap_access_policy_check/fvnsEncapBlk_overlap_malformed_dn.json

@@ -0,0 +1,28 @@
+[
+  {
+    "fvnsEncapBlk": {
+      "attributes": {
+        "allocMode": "static",
+        "annotation": "orchestrator:aci-containers-controller",
+        "rn": "from-[vlan-4000]-to-[vlan-4094]",
+        "role": "external",
+        "from": "vlan-4000",
+        "to": "vlan-4094",
+        "dn": "uni/infra/vlanpool/vlan-4000-4094"
+      }
+    }
+  },
+  {
+    "fvnsEncapBlk": {
+      "attributes": {
+        "allocMode": "static",
+        "annotation": "orchestrator:aci-containers-controller",
+        "rn": "from-[vlan-400]-to-[vlan-4094]",
+        "role": "external",
+        "from": "vlan-400",
+        "to": "vlan-4094",
+        "dn": "uni/infra/vlanpool/vlan-400-4094"
+      }
+    }
+  }
+]

tests/checks/infravlan_overlap_access_policy_check/fvnsEncapBlk_overlap_mixed_valid_malformed_dn.json

@@ -0,0 +1,41 @@
+[
+  {
+    "fvnsEncapBlk": {
+      "attributes": {
+        "allocMode": "static",
+        "annotation": "orchestrator:aci-containers-controller",
+        "rn": "from-[vlan-100]-to-[vlan-4094]",
+        "role": "external",
+        "from": "vlan-100",
+        "to": "vlan-4094",
+        "dn": "uni/infra/vlanns-[vlan_pool1]-static/from-[vlan-100]-to-[vlan-4094]"
+      }
+    }
+  },
+  {
+    "fvnsEncapBlk": {
+      "attributes": {
+        "allocMode": "static",
+        "annotation": "orchestrator:aci-containers-controller",
+        "rn": "from-[vlan-4000]-to-[vlan-4094]",
+        "role": "external",
+        "from": "vlan-4000",
+        "to": "vlan-4094",
+        "dn": "uni/infra/vlanpool/vlan-4000-4094"
+      }
+    }
+  },
+  {
+    "fvnsEncapBlk": {
+      "attributes": {
+        "allocMode": "static",
+        "annotation": "orchestrator:aci-containers-controller",
+        "rn": "from-[vlan-400]-to-[vlan-4094]",
+        "role": "external",
+        "from": "vlan-400",
+        "to": "vlan-4094",
+        "dn": "uni/infra/vlanpool/vlan-400-4094"
+      }
+    }
+  }
+]