Cumulus Linux 5.18 Release Notes
Download all 5.18 release notes as .xls5.18.0 Release Notes
Open Issues in 5.18.0
| Issue ID | Description | Affects | Fixed |
|---|---|---|---|
| 5175518 | The switchd watchdog crashes due to a netlink buffer overflow triggered by continuous next hop group churn. | 5.16.1, 5.16.6-5.18.0 | |
| 5174873 | On an EVPN MH topology with route leaking, if we enable Layer 3 VXLAN Device Mode from existing Single VXLAN Device for All Layer 3 VNIs model, FDB/mac entry is not installed in hardware for some remote VTEP router macs. This affects L3 VxLAN traffic through the VTEPs whose RMACs are not installed on the DUT. | 5.18.0 | |
| 5174595 | On an EVPN MH topology with route leaking, if we enable Layer 3 VXLAN Device Mode from existing Single VXLAN Device for All Layer 3 VNIs model, cl-route-check errors are observed. Neighbor entry is not resolved for the next hop and hence traffic on the routes shown in cl-route-check errors will be impacted. | 5.18.0 | |
| 5165432, 5154620 | With EVPN L3VXI mode enabled, routes leaked between tenant vrfs (using import vrfs) are installed without the encap info leading to blackholing of the traffic. | 5.18.0 | |
| 5159852, 4667526 | When you configure multiple parallel IPv6 numbered eBGP sessions between the same pair of switches, some sessions can remain in an Idle state during simultaneous link or session bringup. Affected sessions repeatedly report Cease/Connection Collision Resolution. To work around this issue, configure update-source separately for every numbered IPv6 BGP neighbor on both switches, using the local IPv6 address assigned to that neighbor’s link.Do not configure a single shared source on the peer group when each parallel link has a different local address. After applying the configuration, clear the affected BGP sessions to remove any existing incorrectly associated connections. | 5.18.0 | |
| 5158643 | The nv show evpn l3vxi –output json command returns an empty dictionary ({}). To work around this issue, run the nv show evpn l3vxi –rev=applied –output json command instead. | 5.18.0 | |
| 5146099 | When operating at 100 percent line rate traffic runs from IXIA, the system experiences packet loss or latency in different traffic RFC tests. To work around this issue, configure the line rate at 99.9 percent and use ports from different IXIA Resource Groups. | 5.18.0 | |
| 5107338 | onie-install, onie-select, and cl-image-upgrade now allow only one instance of each to run at the same time, except for read (status check), which you can use at any time. | 5.18.0 | |
| 5008545, 5108365 | After upgrading Cumulus Linux, NVUE becomes unresponsive and the collector stops receiving gNMI telemetry data. | 5.16.1, 5.16.6-5.18.0 | |
| 5003807 | Sometimes, gNMI does not export SRv6 and Packet Trimming AI ethernet statistics metrics. | 5.16.1, 5.16.6-5.18.0 | |
| 5002002 | When using an IPv6 VXLAN tunnel IP address, FRR treats the received type-3 EVPN route as a withdraw. | 5.16.1, 5.16.6-5.18.0 | |
| 4999234 | The AI Ethernet statistics metrics collection sometimes times out and does not return any data. | 5.16.1, 5.16.6-5.18.0 | |
| 4993970 | Under certain conditions, AAA authentication restriction lockout attempts might not lock TACACS users out for failed REST API logins. | 5.17.0-5.18.0 | |
| 4992289 | After optimized image upgrade, the SSH service fails and NVUE shows an error Failed to translate the startup configuration, will continue with the original startup. | 5.16.1, 5.16.6-5.18.0 | |
| 4989426 | The nv show interface qos-roce-status command causes HIGH CPU. | 5.16.0-5.16.1, 5.16.6-5.18.0 | |
| 4988339 | You might see the following Sxd-kernel errors about late completion and new maximum time between iterations detected.kernel: [875348.575113] sxd_kernel: dev_id=1: Receive late completion for dqn (0) idx (65) | 5.16.1, 5.16.6-5.18.0 | |
| 4982910 | The mellanox platform driver fails to register a pm_power_off handler for legacy platforms. As a result, it falls through to ACPI power off which doesn’t work correctly on the BIOS and causes a reset. | 5.17.0-5.18.0 | |
| 4891440 | The nv show interface qos-roce-status command causes HIGH CPU. | 5.16.0-5.16.1, 5.16.6-5.18.0 | |
| 4875306 | You might see traffic drops on SLAAC and 802.1x interfaces. | 5.16.0-5.16.1, 5.16.6-5.18.0 | |
| 4871161 | If you use NVUE commands to change the BGP autonomous system number (ASN) for existing VRFs without deleting the associated EVPN VNI, FRR reload fails and shows an error during nv config apply. Be sure to delete the layer 3 VNI before changing the BGP ASN or restart FRR after the AS change. | 5.9.1-5.15.1, 5.16.0-5.16.1, 5.16.6-5.18.0 | |
| 4841491 | When the Management-Privilege-Level or Cisco-Avpair is not found, a user is created with privilege level 0 instead of privilege level 1. | 5.16.0-5.16.1, 5.16.6-5.18.0 | |
| 4774686, 4764590 | The final hop does not respond to traceroute with the layer 4 protocol set to TCP or UDP. | 5.16.0-5.16.1, 5.16.6-5.18.0 | |
| 4722680 | If you install RADIUS client packages when rolling back a two partition upgrade, the /var/lib/nvue, /var/lib/ntpsec, and /var/lib/snmp directories might have incorrect ownership after rollback and the nvued service might fail to start up. To work around this issue, run the following commands:sudo chown -R nvue /var/lib/nvue | 5.11.4-5.15.1, 5.16.0-5.16.1, 5.16.6-5.18.0 | |
| 4667792 | Usernames longer than 32 characters do not authenticate against the switch. Avoid using long usernames. | 5.14.0-5.15.1, 5.16.0-5.16.1, 5.16.6-5.18.0 | |
| 4662854 | If you configure a DSCP match as ANY, the gNMI subscription does not show DSCP as ANY. The OpenConfig model supports only integer DSCP values. | 5.15.0-5.15.1, 5.16.0-5.16.1, 5.16.6-5.18.0 | |
| 4657192, 4414675 | On the NVIDIA SN5640 switch, after you configure a port as unsplit, links do not come up while optics are in use. To work around this issue, use copper cables. | 5.15.0-5.15.1, 5.16.0-5.16.1, 5.16.6-5.18.0 | |
| 4648833, 4662556, 4687350 | Interfaces using PAM4 DAC cables on switches with Spectrum-4 and later might not come up after a link flap or reboot if auto-negotiation is disabled. Auto-negotiation is required for PAM4 DAC cables on these switches. | 5.15.0-5.15.1, 5.16.0-5.16.1, 5.16.6-5.18.0 | |
| 4608614 | When setting up SSH keys, you have to run nv config apply twice for the configuration to take effect. | 5.11.3-5.15.1, 5.16.0-5.16.1, 5.16.6-5.18.0 | |
| 4582679 | If a node has Suppress Route Advertisement enabled and routes are re-learned; for example, when a peer sends the route again due to route policy changes, or you enable or disable graceful shutdown, not all routes are offloaded, which might cause discrepancies in traffic. | 5.9.4-5.15.1, 5.16.0-5.16.1, 5.16.6-5.18.0 | |
| 4579237, 4579234 | If interface statistics telemetry is running on the switch, an interface_stats_collector core file might generate during statistics collection. | 5.11.3-5.15.1, 5.16.0-5.16.1, 5.16.6-5.18.0 | |
| 4551249, 4572507, 4573399, 4712858, 4919013 | The NVUE service might fail during switch upgrade. To work around this issue, stop the sysmonitor with the sudo systemctl stop sysmonitor command, then upgrade the switch with the nv action upgrade system packages to latest command. | 5.14.0-5.15.1, 5.16.0-5.16.1, 5.16.6-5.18.0 | |
| 4549896 | When you try to set a VXLAN with a bridge, you see the error sx_sdk: 22985 [BRIDGE] [ERROR ]: Port(0x200A000D)) already added to a bridge. You can safely ignore this error. | 5.14.0-5.15.1, 5.16.0-5.16.1, 5.16.6-5.18.0 | |
| 4548512 | When a connected route for an SVI interface with VRR configured is installed by FRR, the route might be installed with the next hop interface of the VRR device instead of the SVI. For example, instead of interface vlan10, the route might install against vlan10-v0. This prevents next-hop tracking and route installation into hardware.This issue can occur under the following conditions:
To work around this issue, restart the FRR service with the sudo systemctl restart frr.service command. | 5.11.0-5.15.1, 5.16.0-5.16.1, 5.16.6-5.18.0 | |
| 4547463, 4705370 | When you run nv action boot-next commands during optimized image upgrade, the commands time out. This does not indicate that an issue occurred; the system might still be executing the action.To check that the action command completed before going to the next step to reboot the system:
| 5.14.0-5.15.1, 5.16.0-5.16.1, 5.16.6-5.18.0 | |
| 4535806 | After a factory reset, the switch does not clear the /var/tmp directory, which the switch uses for temporary files. | 5.14.0-5.15.1, 5.16.0-5.16.1, 5.16.6-5.18.0 | |
| 4535749 | The uc-discards field in the nv show interface command output is actually the number of packets discarded per queue, but it is wrongly interpreted as bytes. To work around this issue, convert the data shown in bytes to packets by multiplying by 1024 if the data is in KB, 1024x1024 if the data is in MB, and 1024x1024x1024 if the data is in GB. | 5.11.0-5.15.1, 5.16.0-5.16.1, 5.16.6-5.18.0 | |
| 4535699 | When you configure the RADIUS authentication order with local first and radius second, the RADIUS user is authenticated as a default user name. | 5.11.3-5.15.1, 5.16.0-5.16.1, 5.16.6-5.18.0 | |
| 4534357 | During Cumulus Linux upgrade or downgrade, rsyslog might crash because the management (eth0) port is unavailable, which triggers a use-after-free fault and produces a cl-support file as a response. | 5.13.1-5.15.1, 5.16.0-5.16.1, 5.16.6-5.18.0 | |
| 4531960 | The GNMI Subscription to xpath interfaces/interface[name=swp61s0]/state/counters/out-pkts with a high sample interval results in an initial response of zero but in subsequent updates, the value is correct. You do not see this issue when the sample interval is 1 second. | 5.14.0-5.15.1, 5.16.0-5.16.1, 5.16.6-5.18.0 | |
| 4509255, 4546858 | In PTP two-step, the hardware incorrectly modifies the SYNC message correction field. | 5.12.0-5.15.1, 5.16.0-5.16.1, 5.16.6-5.18.0 | |
| 4508830 | Cumulus Linux allows you to add bond ports of mismatched speeds (such as 10G and 25G) to the same LACP bond without error and the bond reports UP. | 5.11.2-5.15.1, 5.16.0-5.16.1, 5.16.6-5.18.0 | |
| 4501632, 4530257 | NVIDIA recommends you wait for approximately 60 seconds after running nv config apply before power cycling the switch so that the NVUE database has time to sync to the filesystem. | 5.14.0-5.15.1, 5.16.0-5.16.1, 5.16.6-5.18.0 | |
| 4495383, 4493988 | NVUE configuration yaml file translation converts unset commands to set commands because the translation logic expects only set commands. | 5.13.0-5.15.1, 5.16.0-5.16.1, 5.16.6-5.18.0 | |
| 4495231 | If the hardware clock date is later than 2038-01-19 03:14:07 UTC, the image might fail to install due to a grub-install failure on the EFI filesystem, which is a VFAT filesystem. As a result, you see the grub prompt immediately after reboot. To work around this issue, reboot from the grub prompt to go into ONIE. From ONIE, use the date command to set a date before 2038-01-19, then run the hwclock –systohc command to add it to the hardware clock. You can then use onie-nos-install to install the image. | 5.9.0-5.15.1, 5.16.0-5.16.1, 5.16.6-5.18.0 | |
| 4475401 | External input such as Ctrl+\ might trigger core dumps on the serial console from /bin/login. This behavior is caused by external sources, such as console servers or automation tools, and does not reflect a fault in the operating system. As a potential result, the serial console might become unresponsive. | 5.14.0-5.15.1, 5.16.0-5.16.1, 5.16.6-5.18.0 | |
| 4475111 | When you try to convert a layer 3 port that is part of ECMP to a bond member, you might see a failure in the switchd logs. This issue does not have any functional impact. | 5.11.2-5.15.1, 5.16.0-5.16.1, 5.16.6-5.18.0 | 5.9.4 |
| 4475074 | The SN5610 switch records a High FEC Bin Error at room temperature. | 5.13.0-5.15.1, 5.16.0-5.16.1, 5.16.6-5.18.0 | 5.11.2 |
| 4440766 | When you try to delete a trusted ca key, Cumulus Linux shows an incorrect error message. To remove a trusted ca key, you must unset the key ID, not the key literal. | 5.13.0-5.15.1, 5.16.0-5.16.1, 5.16.6-5.18.0 | |
| 4423248 | If you unset an interface static IP address when the interface IP gateway is configured, the nv config apply command fails with an ifreload.service error. To work around this issue, unset both the static IP address and gateway together. | 5.9.0-5.15.1, 5.16.0-5.16.1, 5.16.6-5.18.0 | |
| 4423244 | When you enable, then disable adaptive routing, the BGP neighbors might go down because of an unresolved MAC address. To work around this issue, configure another attribute on the interface. | 5.9.0-5.15.1, 5.16.0-5.16.1, 5.16.6-5.18.0 | |
| 4423175 | When you configure an API port with a TCP port already in use, the nginx server fails to restart. | 5.13.0-5.15.1, 5.16.0-5.16.1, 5.16.6-5.18.0 | |
| 4413589 | A MAC-only EVPN type-2 route is wrongly advertised with the layer 3 VNI label in the BGP NLRI (Network Layer Reachability Information). Although this does not have any functional impact, it is not the desired RFC behavior. | 5.13.0-5.15.1, 5.16.0-5.16.1, 5.16.6-5.18.0 | |
| 4337278 | Statically configured VXLAN entries sometimes age out after a peer link flap. | 5.12.0-5.15.1, 5.16.0-5.16.1, 5.16.6-5.18.0 | |
| 4329931 | Cumulus Linux incorrectly allows SyncE and PPS to be enabled at the same time. Upgrading systems with both features configured using NVUE to 5.12.0 or later results in a failure to apply the startup configuration as part of the first boot of the upgraded version. To work around the issue, unset one of the features before you upgrade. | 5.12.0-5.15.1, 5.16.0-5.16.1, 5.16.6-5.18.0 | |
| 4309876 | When you configure an invalid switch port (swp), NVUE adds the invalid configuration instead of rejecting it. The invalid interface in the configuration does not have any functional impact. | 5.12.0-5.15.1, 5.16.0-5.16.1, 5.16.6-5.18.0 | |
| 4308857 | When you use tls_crlcheck in the /etc/nslcd.conf file, the optional nslcd service fails due to a missing library. | 5.9.2-5.9.3, 5.12.0-5.15.1, 5.16.0-5.16.1, 5.16.6-5.18.0 | 5.9.4 |
| 4294156 | After you clear the RoCE counters with the nv action clear interface command, the buffer-max-usage counters in the nv show interface command output do not show updated (cleared) values. | 5.12.0-5.15.1, 5.16.0-5.16.1, 5.16.6-5.18.0 | |
| 4277042 | On the NVIDIA SN5600 switch, you see low power alarms immediately after a reboot. The alarms disappear after showing up initially. Certain modules typically show low power alarms on initialization. No action is needed. | 5.12.0-5.15.1, 5.16.0-5.16.1, 5.16.6-5.18.0 | |
| 4249096 | Binary upgrade from Cumulus Linux 4.3.1 to 5.12.0 and later is not supported. To work around this issue, perform a binary upgrade from Cumulus Linux 4.3.1 to 5.9.0, then perform a binary upgrade from Cumulus Linux 5.9.0 to 5.12.0 or later. | 5.12.0-5.15.1, 5.16.0-5.16.1, 5.16.6-5.18.0 | |
| 4236419 | On the Spectrum-3 switch, the PTP offset for 25GbE fluctuates within a range of plus or minus 50 nanoseconds beyond the expected values. | 5.12.0-5.15.1, 5.16.0-5.16.1, 5.16.6-5.18.0 | |
| 4214678 | Changes to open telemetry configuration or export states restarts the telemetry service and resets all health metrics. | 5.12.0-5.15.1, 5.16.0-5.16.1, 5.16.6-5.18.0 | |
| 4177067 | When performing a package upgrade, nslcd installation might open an interactive dialog to configure nslcd.conf.To avoid this interactive dialog, set the DEBIAN_FRONTEND environment variable to noninteractive. For example:cumulus@switch:~$ sudo apt-get update | 5.11.0-5.15.1, 5.16.0-5.16.1, 5.16.6-5.18.0 | |
| 4154839, 4280933, 4291934 | When you run certain SDK commands (such as sudo sx_api_port_counter_dump_all.py or sx_api_fdb_dump) first as the cumulus user, then with sudo, you see the following error:PermissionError: Errno 13] Permission denied: ‘/tmp/python_err_log.txt’ To resolve this issue, run the rm -rf /tmp/python_err_log.txt command. | 5.11.0-5.15.1, 5.16.0-5.16.1, 5.16.6-5.18.0 | |
| 4142857 | The switch drops PTP packets received with extra ethernet padding and you see syslog [ptp4l.ERR] messages. | 5.10.0-5.15.1, 5.16.0-5.16.1, 5.16.6-5.18.0 | |
| 4139511, 4184813, 4180112 | When you generate the cl-support file on the Spectrum-4 switch, the following messages appear on the serial console. You can safely ignore this issue.[ 1903.595131] mlxsw_minimal 2-0048: Could not acquire lock | 5.11.0-5.15.1, 5.16.0-5.16.1, 5.16.6-5.18.0 | |
| 4134447 | The journal logs might include the error message ERR kernel: [ 7.453789] usb usb2-port2: connect-debounce failed. You can safely ignore this log message. | 5.11.0-5.15.1, 5.16.0-5.16.1, 5.16.6-5.18.0 | |
| 4129757 | If you include a comma in the BGP community list, extended community list, or large community list regex expression of a routing policy, you see error messages and FRR reload fails. Make sure the regex expression does not contain a comma. For example, instead of ^65550:([0-9]{1,2}|[1-9][1-9]):.$, specify ^65550:([0-9]|[0-9][0-9]):.$ and instead of ^65550:([0-4]{1,2}|[7-9][8-9]):.$, specify ^65550:([0-4]|[0-4][0-4]|[7-9][8-9]):.$. | 5.11.0-5.15.1, 5.16.0-5.16.1, 5.16.6-5.18.0 | |
| 4124376, 4316163 | The SN3700C-S, SN5400, and SN5600 secure boot switch running Cumulus Linux 5.11.0 or later boots with shim 15.8 that adds entries to the SBAT revocations to prevent the switch from booting shim 15.7 or earlier (included in Cumulus Linux 5.10 and earlier). To downgrade a secure boot switch from Cumulus Linux 5.11.0 or later, or to recover a downgraded switch that does not boot, follow the steps in Downgrade a Secure Boot Switch. | 5.11.0-5.15.1, 5.16.0-5.16.1, 5.16.6-5.18.0 | |
| 4118970 | When running PTP, the performance for 100Gx2 and 400Gx8 can have a high offset in up to 1.5% of the sampling. | 5.11.0-5.15.1, 5.16.0-5.16.1, 5.16.6-5.18.0 | |
| 4105127, 4796391 | Any sFlow configuration changes that require an hsflowd restart are operational only after an initial delay of 60 seconds. | 5.11.0-5.15.1, 5.16.0-5.16.1, 5.16.6-5.18.0 | |
| 4100629 | NVUE show command outputs show LLDP neighbor changes only after the LLDP update frequency multiplied by the hold time. | 5.11.0-5.15.1, 5.16.0-5.16.1, 5.16.6-5.18.0 | |
| 4082210 | When you change the CPU resource limit with the nv set service control rsyslog resource-limit cpu command, the rsyslog agent does not start. To work around this issue, increase the CPU resource limit, then restart the service manually. | 5.11.0-5.15.1, 5.16.0-5.16.1, 5.16.6-5.18.0 | |
| 4077921 | You cannot use package upgrade to upgrade from Cumulus Linux 5.9.2 to Cumulus Linux 5.10.1 or later. You must install the Cumulus Linux image instead. | 5.10.1-5.15.1, 5.16.0-5.16.1, 5.16.6-5.18.0 | |
| 4049213, 4186873 | When there are routes that point to a single next hop, an ECMP entry is created in the SDK. After the single next hop from the route is removed, the ECMP entry might stay in the SDK until the time the next hop is present in the kernel. | 5.9.2-5.15.1, 5.16.0-5.16.1, 5.16.6-5.18.0 | |
| 4047798 | Packet distribution based on ECMP hashing using GTP-TEID does not function as expected in an EVPN Clos topology. | 5.10.0-5.15.1, 5.16.0-5.16.1, 5.16.6-5.18.0 | |
| 4030380 | When you roll back interface configuration to the default setting with the nv unset interface command, NVUE removes the complete entry for the interface from the /etc/network/interface file, and puts the interface in admin down. As a result, you cannot configure FEC on the interface at the lower layers. | 5.10.0-5.15.1, 5.16.0-5.16.1, 5.16.6-5.18.0 | |
| 4005422, 4015452 | When you upgrade Cumulus Linux 5.9.1 to Cumulus Linux 5.10 or later with package upgrade, the NTP service stops. To restart the NTP service, enable, then restart the service in the VRF in which it was running with the systemctl enable ntpsec@ and systemctl restart ntpsec@ commands. | 5.10.0-5.15.1, 5.16.0-5.16.1, 5.16.6-5.18.0 | |
| 3985682 | On Spectrum-4 switches, multicast flows containing packets smaller than 512 bytes might not reach full line rate. Cumulus Linux supports 512 byte and larger multicast packets. | 5.10.0-5.15.1, 5.16.0-5.16.1, 5.16.6-5.18.0 | |
| 3966312 | When connecting the SN5xxx switch to third party test equipment (such as IXIA) using copper cables at 100GbE, 200GbE, 400GbE, or 800GbE, links do not come up. | 5.10.0-5.15.1, 5.16.0-5.16.1, 5.16.6-5.18.0 | |
| 3948068 | On the SN3700 and SN3700c switch, the nv show platform environment voltage command output shows a failed state for the PSU-n-12V-RAIL-OUT sensors. This is a known hardware limitation that cannot be corrected by the PSU vendor. | 5.10.0-5.15.1, 5.16.0-5.16.1, 5.16.6-5.18.0 | |
| 3915878 | If you configure remote syslog export through a non-default VRF, you might see repeated error logs from the rsyslog process while the switch is booting:rsyslogd: create UDP socket bound to device failed: No such device [v8.2302.0]rsyslogd: No UDP socket could successfully be initialized, some functionality may be disabled. [v8.2302.0] The logs occur because the rsyslog service starts before the networking service creates the configured VRF for syslog export. There is no functional impact with this issue. | 5.9.0-5.15.1, 5.16.0-5.16.1, 5.16.6-5.18.0 | |
| 3879717 | Running snmpwalk on the switch with the management IP address does not work. To work around this issue, use the localhost option (snmpwalk -v 2c -c public28 localhost 1.3.6.1.2.1.14) or create a control plane ACL whitelist rule. | 5.10.0-5.15.1, 5.16.0-5.16.1, 5.16.6-5.18.0 | |
| 3878394 | When ZTP runs a script that contains wget, ZTP fails and you see a message similar to the following:ZTP: ZTP DHCP: Unexpected error: ‘ascii’ codec can’t decode byte 0xe2 in position 181: ordinal not in range(128)ZTP: Script returned failure To work around this issue, use the -q option with wget. | 5.9.0-5.15.1, 5.16.0-5.16.1, 5.16.6-5.18.0 | |
| 3877516 | When you connect two NVIDIA switches and configure 400G speed in force mode, links don’t come up. To work around this issue, make sure auto-negotiation is always on when connecting NVIDIA to NVIDIA in PAM4. | 5.9.0-5.15.1, 5.16.0-5.16.1, 5.16.6-5.18.0 | |
| 3875373 | When you run the nv config apply empty command, NVUE removes the cumulus user. If you are logged in as the cumulus user when you run the nv config apply empty command, the command fails. | 5.9.0-5.15.1, 5.16.0-5.16.1, 5.16.6-5.18.0 | |
| 3861745 | On UEFI hardware (where the /sys/firmware/efi directory exists), using the update-grub program might generate a /boot/grub/grub.cfg that is incorrect for booting ONIE if the ONIE option is selected on the console while booting. To work around this issue, run mount LABEL=“EFI System” /boot/efi before using update-grub. | 5.9.0-5.15.1, 5.16.0-5.16.1, 5.16.6-5.18.0 | |
| 3855796 | When configuring a Unicast Master Table for clients, the server addresses must be reachable and the route to the destination must exist. The unicast table can have one directly-connected port for a client. This restriction is only for directly connected ports and doesn’t apply to Unicast Servers on other devices or switches. | 5.9.0-5.15.1, 5.16.0-5.16.1, 5.16.6-5.18.0 | |
| 3847439 | In rare cases on the Spectrum 1 switch, where a dual connected host transmits all traffic flows to only one switch in a connected MLAG pair, and the host changes behavior to hash all flows to the other MLAG switch, there might be traffic loss if the MAC FDB entry on the original switch ages out. | 5.9.0-5.15.1, 5.16.0-5.16.1, 5.16.6-5.18.0 | |
| 3819945 | When you connect an NVIDIA SN4410, SN4700, or SN5600 switch to any Spectrum 1, Spectrum-2, or Spectrum-3 peer switch (with four lanes) using a 4x breakout configuration and the default lanes per port setting, links do not come up. To work around this issue, provide the lanes per port configuration shown below:cumulus@switch:~$ nv set interface | 5.9.0-5.15.1, 5.16.0-5.16.1, 5.16.6-5.18.0 | |
| 3818545 | The terminal monitoring software SecureCRT has a known issue when running on both Windows and Mac systems where it gets stuck when monitoring the serial port of the switch as Cumulus Linux boots up. When this occurs, the serial port stops as shown below and SecureCRT is unable to receive any more serial data from the switch (it is able to transmit).Mounting dev-hugepages.mount - Huge Pages File System.. | 5.9.0-5.15.1, 5.16.0-5.16.1, 5.16.6-5.18.0 | |
| 3774274 | When you manually configure the /etc/cumulus/datapath/qos/qos_features.conf file without applying the QoS configuration with NVUE, running the nv config apply empty command later does not clean up the QoS configuration. If the QoS configuration includes breakout ports, the nv config apply empty command fails due to a switchd reload trigger failure. To work around this issue, clean up the configuration manually in the /etc/cumulus/datapath/qos/qos_features.conf, then run the nv config apply empty command. | 5.8.0-5.15.1, 5.16.0-5.16.1, 5.16.6-5.18.0 | |
| 3773177 | When you try to upgrade a switch from Cumulus Linux before 5.6.0 with package upgrade, you might see errors for expired GPG keys that prevent you from upgrading. To work around this issue, install the new keys with the following commands, then upgrade the switch.cumulus@switch:~$ wget https://download.nvidia.com/cumulus/apt.cumulusnetworks.com/repo/pool/cumulus/c/cumulus-archive-keyring/cumulus-archive-keyring_4-cl5.6.0u5_all.deb | 4.0.0-4.4.5, 5.0.0-5.15.1, 5.16.0-5.16.1, 5.16.6-5.18.0 | |
| 3771168 | When you perform an ISSU upgrade on a Spectrum 1 switch, the switchd service might crash. | 5.8.0-5.15.1, 5.16.0-5.16.1, 5.16.6-5.18.0 | |
| 3677533 | Due to resource constraints on the Spectrum 1 switch, staticd performance drops and takes longer to read static routes compared to the time BGP takes to complete a graceful restart and advertise routes and EOR to its helpers. As a result, static routes are advertised after the EOR is sent to graceful restart helpers, which delete the stale static routes and relearn them after receiving the EOR from the restarting node. Temporary traffic loss might occur. | 5.7.0-5.15.1, 5.16.0-5.16.1, 5.16.6-5.18.0 | |
| 3655681 | When you disable, then enable STP auto-edge on a port, the port might not transition to the operational edge even though the port does not receive BPDUs. To work around this issue, configure the port as an admin-edge port. | 5.7.0-5.15.1, 5.16.0-5.16.1, 5.16.6-5.18.0 | |
| 3637444 | Applying an inbound control plane ACL on the eth0 management interface does not take effect. To work around this issue, apply the ACL on the mgmt interface; for example, nv set interface mgmt acl . | 5.7.0-5.15.1, 5.16.0-5.16.1, 5.16.6-5.18.0 | |
| 3591918 | The nv action disconnect system aaa user command does not clear all open sessions. To work around this issue, run the command as many times as the number of sessions. | 5.6.0-5.15.1, 5.16.0-5.16.1, 5.16.6-5.18.0 | |
| 3587393 | If you use the NVIDIA SN5600 (Spectrum-4) switch with Ixia test equipment, you might experience delayed link up due to intermittent link flaps. To work around this issue when using copper cables:
To work around this issue when using fiber cables:
| 5.6.0-5.15.1, 5.16.0-5.16.1, 5.16.6-5.18.0 | |
| 3556762, 3463827 | On rare occasions, SPT switchover might not happen cleanly in PIM resulting in some dropped packets. If you use PIM-SM to replicate EVPN BUM traffic, you might see a brief drop of multicast traffic before recovering due to normal PIM-SM traffic timeout. | 5.5.0-5.15.1, 5.16.0-5.16.1, 5.16.6-5.18.0 | |
| 3540510 | 400Gx8 ports only support traffic line rate with packets that are larger than 172 bytes. | 5.6.0-5.15.1, 5.16.0-5.16.1, 5.16.6-5.18.0 | |
| 3538321, 3564344 | In rare cases, an STP topology change on PTP over a VLAN can result in the switch losing the slave state and one of the ports might remain in an uncalibrated state. To work around this issue, toggle the port that is in the uncalibrated state up and down so that one of the ports is selected as the slave. | 5.6.0-5.15.1, 5.16.0-5.16.1, 5.16.6-5.18.0 | |
| 3497622 | When you remove PSUs, then plug them back in, you might experience traffic loss and some ports might be in a down state. | 5.6.0-5.15.1, 5.16.0-5.16.1, 5.16.6-5.18.0 | |
| 3472163 | On a switch with the Spectrum-4 ASIC, packets that are smaller than 256 bytes are not included in multicast flows. Multicast flows support packets that are 256 bytes or larger. | 5.6.0-5.15.1, 5.16.0-5.16.1, 5.16.6-5.18.0 | |
| 3444490 | Migration from ONYX to Cumulus Linux is supported and tested with ONYX version 3.10.4302 GA only. | 5.6.0-5.15.1, 5.16.0-5.16.1, 5.16.6-5.18.0 | |
| 3442569, 3520880, 3586421 | When trying to access the NVUE API, user accounts authenticated with a newly-configured external service, such as TACACS, RADIUS, or LDAP, receive a 401 forbidden error. To work around this issue, after enabling a new authentication service, make sure to restart both nginx.service and nvued.service to begin authenticating users against the new authentication service. | 5.5.0-5.15.1, 5.16.0-5.16.1, 5.16.6-5.18.0 | |
| 3430430, 3337848 | When you configure PTP on 50G ports, the offset correction might be higher, which can affect the time synchronization of the node. To work around this issue, configure PTP on 100G ports, or on 10G or 1G ports with PTP shaper enabled. | 5.5.0-5.15.1, 5.16.0-5.16.1, 5.16.6-5.18.0 | |
| 3424967, 3413785 | sudo for TACACS+ users with privilege level 15 does not work when reaching the TACACS+ server through the default VRF. To work around this issue, specify the interface name that the default VRF uses in the vrf= setting of the /etc/tacplus_servers file or run the NVUE nv set system aaa tacacs vrf command. If you don’t run either command, a TACACS+ user with privilege level 15 can run vrf task exec default sudo … to execute the sudo command. | 5.0.0-5.15.1, 5.16.0-5.16.1, 5.16.6-5.18.0 | |
| 3420056 | The ADVA 5401 SFP module with hardware revision 5.01 does not come up at layer 1 when you use 10G QSA adaptors. To work around this issue, use 25G QSA adaptors. | 4.4.0-4.4.5, 5.0.0-5.15.1, 5.16.0-5.16.1, 5.16.6-5.18.0 | |
| 3414866, 3536555, 4465009, 4509253, 4732973 | Each VLAN is represented as a bitmap on the underlying port and when you add multiple VLANs together, Cumulus Linux iterates over the existing ones and updates the diff. However, in few corner cases, the same bitmap might be repeated again causing the following error.sx_sdk: 22985 [BRIDGE] [ERROR ]: Port(0x200A000D)) already added to a bridge You can ignore this error; it has no impact on switch functionality. | 5.6.0-5.15.1, 5.16.0-5.16.1, 5.16.6-5.18.0 | |
| 3362113 | If you restore an NVUE startup.yaml file or run the nv config patch command after an upgrade that includes breakout ports with QoS configuration, the NVUE configuration fails to apply. Subsequent attempts to run nv config apply fail with a message similar to Invalid config [rev_id: 11] qos config is not supported on the following invalid interface: swp1s0. Supported on swp and bond interface types. To work around this issue, run nv unset on the configured QoS settings, then apply the breakout port configuration before you configure QoS. Alternatively, you can remove the QoS configuration from the yaml file and patch it separately after applying the breakout configuration. | 5.4.0-5.15.1, 5.16.0-5.16.1, 5.16.6-5.18.0 | |
| 3347538 | When connecting NVIDIA-to-NVIDIA in PAM4, you must enable auto-negotiation. | 5.4.0-5.15.1, 5.16.0-5.16.1, 5.16.6-5.18.0 | |
| 3341214 | If you use the NVUE REST API to configure a local user with a hashed password, the user cannot log in and the /etc/nvue.d/startup.yaml file shows the password as plain text. | 5.4.0-5.15.1, 5.16.0-5.16.1, 5.16.6-5.18.0 | |
| 3329518 | When using TACACS+, if the /etc/nsswitch.conf file specifies passwd: files tacplus (files is listed before tacplus), a user that is present in both the local /etc/passwd file and the TACACS+ server cannot log into the switch. NVIDIA recommends that when using TACACS+, you list tacplus before files in /etc/nsswitch.conf. When using NVUE, ensure that tacacs has priority over local. | 5.4.0-5.15.1, 5.16.0-5.16.1, 5.16.6-5.18.0 | |
| 3327477 | If you use su to change to a user specified through TACACS+, the user becomes the local tacacs0 thru tacacs15 user instead of the named user to run sudo commands. As a result, the named user password might not match the local tacacs0 thru tacacs15 user password. | 3.7.0-3.7.16, 4.0.0-4.4.5, 5.0.0-5.15.1, 5.16.0-5.16.1, 5.16.6-5.18.0 | |
| 3326659 | If you have a large number of MAC addresses, they do not age out at the MAC ageing timeout value configured on the switch. It might take up to 30 seconds more for the MAC addresses to age out and be deleted from the hardware. To work around this issue, wait for the ageing timeout value plus 30 seconds. | 5.4.0-5.15.1, 5.16.0-5.16.1, 5.16.6-5.18.0 | |
| 3253218 | Auto-negotiation isn’t supported on Spectrum-2 and Spectrum-3 switches using the 1G SFP-T module; FORCE 1G is configured instead. | 5.4.0-5.15.1, 5.16.0-5.16.1, 5.16.6-5.18.0 | |
| 3241567 | When you apply switch configuration for the first time on a freshly booted switch and you run the nv config apply command after setting the hostname with nv set system hostname, you might see the error message Failed to start Hostname Service. To work around this issue, run the nv config apply command a second time. | 5.3.0-5.15.1, 5.16.0-5.16.1, 5.16.6-5.18.0 | |
| 3226506 | The l1-show eth0 command does not show port information and is not supported in this release. | 5.3.0-5.15.1, 5.16.0-5.16.1, 5.16.6-5.18.0 | |
| 3225117, 3158720 | Occasionally, packet loss might occur on 25G ports when the link is raised without FEC. | 5.4.0-5.15.1, 5.16.0-5.16.1, 5.16.6-5.18.0 | |
| 3172504 | When you connect the NVIDIA SN4600C switch to a Spectrum 1 or Spectrum-3 switch with a 40GbE passive copper cable (Part Number: MC2210126-005) on edge ports 1-4 and 61-64, there is an Effective BER of 1E-12 in PHY. | 5.2.0-5.15.1, 5.16.0-5.16.1, 5.16.6-5.18.0 | |
| 3147782 | You cannot use NVUE to configure an SNMP view to include a subtree beginning with a period. For example:cumulus@switch:~$ nv set service snmp-server viewname cumulusOnly included .1.3.6.1.4.1.40310Error: GET /nvue_v1/service/snmp-server/viewname/cumulusOnly/included?pointers=%5B%22%2Fparameters%22%2C+%22%2Fpatch%2FrequestBody%2Fcontent%2Fapplication~1json%2Fschema%22%2C+%22%2Fpatch%2Fparameters%22%2C+%22%2Fpatch%2Fresponses%2F200%2Flinks%22%5D responded with 404 NOT FOUNDTo work around this issue, reference the OID without the preceding period ( . ) in the command. | 5.3.0-5.15.1, 5.16.0-5.16.1, 5.16.6-5.18.0 | |
| 3145869, 3430508, 3543102 | On a Spectrum-3 switch, the PTP offset in 10GbE changes between plus or minus 27. The average offset is around 7. | 5.2.0-5.15.1, 5.16.0-5.16.1, 5.16.6-5.18.0 | |
| 3135952 | PAM4 split cables (such as 2x100G, 4x100G, and 4x50G) do not work with a forced speed setting (when auto-negotiation is off) as the default speed enabled is for NRZ mode (such as 100G_4X). To work around this issue, set the appropriate lanes for forced speed (with auto-negotation off) with the ethtool -s swpX speed <port_speed> autoneg off lanes <no_of_lanes> command. For example:cumulus@switch:~$ sudo ethtool -s swp1 speed 100000 autoneg off lanes 2 | 5.2.0-5.15.1, 5.16.0-5.16.1, 5.16.6-5.18.0 | |
| 3115242 | When you configure two VNIs in the same VLAN, ifupdown2 shows a vlan added to two or more VXLANS warning, which is only issued after the VNI is already added to the bridge. This leaves the new VNI in the PVID even if there is already an existing VNI configured in that PVID. | 5.1.0-5.15.1, 5.16.0-5.16.1, 5.16.6-5.18.0 | |
| 3103821 | On the NVIDIA SN4700 switch, inserting and removing the PSU might cause loss of frames. | 5.2.0-5.15.1, 5.16.0-5.16.1, 5.16.6-5.18.0 | |
| 3084476 | After you disable traffic shaping in the /etc/cumulus/datapath/qos/qos_features.conf file, the default QOS traffic shaping configuration does not restore. To work around this issue, restart switchd. | 4.4.3, 5.0.0-5.15.1, 5.16.0-5.16.1, 5.16.6-5.18.0 | 4.4.4-4.4.5 |
| 3084027 | Under a high load, you might see ingress drop counters increase. The drops are classified as HwIfInDiscards in ethtool and shown as ingress_general in hardware. | 4.3.0-4.4.5, 5.0.0-5.15.1, 5.16.0-5.16.1, 5.16.6-5.18.0 | |
| 3071652 | On rare occasions, after you reboot or restart switchd on a Spectrum 1 switch, any 25G connections with Direct Attach Copper (DAC) cables that connect from the switch to a non-NVIDIA device might flap continuously. To work around this issue, bring the affected link administratively down for a few seconds on the non-NVIDIA device, then bring the link back up. | 4.4.4-4.4.5, 5.1.0-5.15.1, 5.16.0-5.16.1, 5.16.6-5.18.0 | |
| 3061656 | When the CPU load is high during a warm boot, bonds with a slow LACP rate fail to forward layer 2 traffic for up to 60 seconds (depending on the duration of the CPU load) and static bonds fail to forward layer 2 traffic for up to 5 seconds. | 5.1.0-5.15.1, 5.16.0-5.16.1, 5.16.6-5.18.0 | |
| 2972540 | With RADIUS enabled for user shell authentication, there might be a delay in local user authentication for non cumulus user accounts. | 5.0.0-5.15.1, 5.16.0-5.16.1, 5.16.6-5.18.0 | |
| 2951110 | The net show time ntp servers command does not show any output with the management VRF. | 3.7.15-3.7.16, 4.1.1-4.4.5, 5.0.0-5.15.1, 5.16.0-5.16.1, 5.16.6-5.18.0 | |
| 2904450, 2553222 | When you run the ethtool -m or the l1-show command, the 400G interface optical values do not show. | 4.4.0-4.4.5, 5.0.0-5.15.1, 5.16.0-5.16.1, 5.16.6-5.18.0 | |
| 2885305, 2887500, 3234087, 3074929, 3293192 | Certain Murata PSU attributes show intermittently in the sensors command output. To work around this issue, upgrade to the latest PSU firmware on Murata. | 5.0.0-5.15.1, 5.16.0-5.16.1, 5.16.6-5.18.0 | |
| 2867042 | When connecting the NVIDIA SN4600 switch to another NVIDIA Spectrum switch, you must use auto-negotiation mode (not force mode); otherwise the switch might use the wrong Tx configuration. | 5.0.0-5.15.1, 5.16.0-5.16.1, 5.16.6-5.18.0 | |
| 2823307 | Cumuls Linux does not support a bond with more than 64 ports. Any configuration with more than 64 ports in a bond changes all ports to down when you apply the configuration. | 5.0.0-5.15.1, 5.16.0-5.16.1, 5.16.6-5.18.0 | |
| 2736108 | When you change the VRRP advertisement interval on the master, the master advertisement interval field in the show vrrp command output does not show the updated value. | 4.4.0-4.4.5, 5.0.0-5.15.1, 5.16.0-5.16.1, 5.16.6-5.18.0 | |
| 2684925 | The NVUE nv show vrf default router bgp peer command produces a 404 not found error. | 4.4.0-4.4.5, 5.0.0-5.15.1, 5.16.0-5.16.1, 5.16.6-5.18.0 | |
| 2671652 | In VXLAN routing environments, you might experience sub-optimal route convergence delays (longer than five seconds) when a prefix transitions to a new ECMP next-hop group. This condition might occur when a VTEP loses ECMP routes through all uplink peerings, then installs the routes through a different path, such as an MLAG peerlink. | 4.4.0-4.4.5, 5.5.0-5.15.1, 5.16.0-5.16.1, 5.16.6-5.18.0 |
Fixed Issues in 5.18.0
| Issue ID | Description | Affects |
|---|---|---|
| 5172157 | The nv config apply command fails to apply configuration changes because NVUE fails to handle stale sessions and does not prompt you to clear them. To work around this issue, run the nv config detach command to clear the stale session, then run the nv config replace command if there is a stale pending revision. | 5.16.6-5.17.0 |
| 5172073 | The LLDP Chassis ID might be non-unique when front-panel ports share MAC addresses. | 5.16.6-5.17.0 |
| 5172071 | When you apply a BGP configuration change that renumbers the IP addresses of peers in a peer group and at removes another peer group at the same time, FRR reload fails. As a result, the FRR service does not reload or restart cleanly and the configuration apply rolls back. | |
| 5167708 | When an ACL policy is reinstalled while ACL rule counter statistics are being collected, a kernel panic can occur and the switch might reboot unexpectedly. The panic occurs because the ACL counter buffer is released while the hardware counter read for that buffer is still in progress. | 5.16.6-5.17.0 |
| 5157588 | When deleting a route map applied to BGP routes carrying multiple extended communities, the policy strips all extended communities instead of removing only the targeted extended community. This issue results in unintended loss of SoO, LB, RT, or other extended‑community attributes during outbound policy evaluation. | |
| 5156936 | When a gNMI client uses a long sample interval, the gNMI server takes a long time to respond even after the gNMI client is reachable. The back-off time interval is now limited to one minute. | |
| 5156722 | The nv show platform firmware command shows an incorrect CPLD firmware version. | 5.16.1 |
| 5152149 | Zebra might crash when recovering routes after a temporary failure to install forwarding next hops. During interface instability or link flapping, some routes might fail to install. Zebra caches those routes for later retry. If a cached route is removed before the next hop is installed successfully, zebra might later access invalid memory while retrying installation and then crash. | 5.11.3-5.15.1, 5.16.0-5.16.1, 5.16.6-5.17.0 |
| 5152101 | When you use NVUE flexible snippets to add custom Debian APT mirrors or sources under /etc/apt/sources.list.d/, the nv config apply command fails because NVUE incorrectly blocks adding snippeted files under /etc/apt/sources.list.d/. | 5.16.1 |
| 5146168 | OTEL export fails if you configure the gRPC endpoint with an IPv6 address. | 5.17.0 |
| 5146058 | On the Spectrum-6 switch, the l1-show command output does not show eyes and grades for bonus or service port swp65s0 and swp65s1. | 5.17.0 |
| 5140761 | A switch reboot might drop the management VRF static route intermittently from the kernel, causing a loss of management-plane reachability. To work around this issue, remove and re-add the route or restart FRR. | 5.16.1 |
| 5135953 | The Date-Time column in the nv show interface output shows the same timestamp for every snapshot row when you set monitor temporality to cumulative. Each snapshot now displays the actual capture time. | 5.16.1 |
| 5135125 | On switches with the Spectrum-4 ASIC, a port configured with a breakout might encounter a firmware (SDK or FW) fatal event when traffic first begins forwarding on the broken-out port. The switch resets the ASIC automatically and restarts switchd to recover. | 5.16.1, 5.16.6-5.17.0 |
| 5130675 | The MFT tool crashes. | 5.17.0 |
| 5124026 | The HFT counter metrics exported over OTLP use incorrect timestamp and metric-type semantics. | 5.17.0 |
| 5123860 | HFT streaming telemetry exported over OTLP sets the timestamp (timeUnixNano) for each OTLP data point from the collection or export time instead of the hardware sample time, and exported monotonic counters as OTLP Gauge instead of Sum. This produces timestamps that do not represent when each sample is actually taken and metric types that prevent correct rate or delta computation by standard OTLP consumers. | 5.17.0 |
| 5118919 | Running nv config apply more than once without waiting for the first nv config apply to finish might cause a deadlock with the second nv config apply and trigger a condition where memory grows unbounded. | 5.16.1, 5.16.6-5.17.0 |
| 5107859 | You see unexpected error logs from SDK Stats Collector. | 5.17.0 |
| 5103277 | In High scale scenario there is a possibility of config datastore miss or corruption in case simultaneous vtysh commands and frr reload or restart | |
| 5103255 | On systems with frequent ACL updates, switchd could fail to release internal SDK resources used for bulk counter notifications during ACL installation. Over long uptime, this could exhaust available resources and cause few metrics to stop updating Workaround: Restarting switchd temporarily restores metrics. | |
| 5102916 | If you disable HFT on the last interface while an HFT session is enabled, NVUE crashes instead of rejecting the configuration change gracefully. | 5.17.0 |
| 5102853 | In High scale scenario there is a possibility of config datastore miss or corruption in case simultaneous vtysh commands and frr reload or restart | |
| 5099633 | There are long delays with NTP time synchronization when the system time changes (rolls back). | 5.16.1, 5.16.6-5.17.0 |
| 5099224 | When interfaces experience authentication failures and retries due to Radius or host misconfiguration, NVUE commands such as nv show interface dot1x-summary and nv show interface dot1x-ipv6-summary become slow and unresponsive. To work around this issue, ensure the RADIUS server is reachable and configured correctly, and that client credentials and certificates are valid. The slowdown is triggered by repeated authentication failures causing deauthentication and re-authentication cycles. Resolving the underlying authentication failures eliminates the blocking behavior. | 5.16.6-5.17.0 |
| 5095504 | Statically configuring an IPv4 or IPv6 address for an 802.1x enabled port that is also configured for dynamic IPv6 is allowed. However, when you upgrade the switch with this configuration, upgrade fails. To work around this issue, remove the statically assigned IPv4 or IPv6 address configured on the 802.1x enabled port configured for Dynamic IPv6 and re-attempt the upgrade. | 5.17.0 |
| 5093840 | Some of the BGP EVPN routes are not installed in the FIB/ASIC. | |
| 5080564 | You can’t stage both ZTP and a startup.yaml file at the same time. | |
| 5080543 | After a switch reboot, the NVUE EVPN operational view (nv show vrf –view=evpn) might report scaled layer 3 VNIs as down with a null router-mac, system-mac, or SVI while FRR correctly reports them as Up. This is an operational-data synchronization issue in the NVUE view with no impact to EVPN forwarding or routing. | |
| 5078019 | The cl-support file takes approximately three minutes to generate with IPv6 routes and and an srv6 full scale configuration. | 5.17.0 |
| 5077002 | The pimd service crashes intermittently and infrequently when VRF transition is applied on an interface that also has PIM enabled. To work around this issue, remove the PIM configuration from the interface, do the VRF transition, then re-enable PIM on the interface. | |
| 5076894 | The gNMI /interfaces/interface[name]/ethernet/state/port-speed path might show the wrong speed. | 5.16.6-5.17.0 |
| 5072600 | The nv show mlag -o json command returns a plain text error instead of a JSON object | 5.11.3-5.15.1, 5.16.0-5.16.1, 5.16.6-5.17.0 |
| 5072239 | On a leaf configured with static permanent IPv6 neighbors on host-facing interfaces, enabling then disabling all protocols in maintenance mode with the nv set maintenance unit all-protocols mode command, removes the static PERMANENT neighbor entries from the kernel. The entries come back as dynamic (REACHABLE), and certain entries never complete neighbor discovery and remain INCOMPLETE, dropping traffic to those host subnets. | 5.17.0 |
| 5070048 | All multihomed downlinks are stuck in protodown state, if the lowest integer valued uplink is down before the mh-uplink knob is enabled on all uplink interfaces. | 5.14.0-5.15.1, 5.16.0-5.16.1, 5.16.6-5.17.0 |
| 5067214 | Running the nv config apply command with no changes returns a warning but the pending revision is not detached. | 5.11.5-5.15.1, 5.16.0-5.16.1, 5.16.6-5.17.0 |
| 5065880 | The nv show interface dot1x-summary command is very slow at high scale. | 5.16.0-5.16.1, 5.16.6-5.17.0 |
| 5065211, 4916985, 5078194 | When data path enablement timing is marginal, traffic might be allowed through the system too early. | 5.11.5-5.15.1, 5.16.0-5.16.1, 5.16.6-5.17.0 |
| 5060140 | The overall packet trimming performance is currently unoptimized, which can result in slower MRC convergence during traffic processing. | |
| 5057971 | On an MLAG pair, after a bridge flap, the connected route for the macvlan interface comes up without the INSTALLED flag, while its SVI on the same prefix is C>*. | 5.11.3-5.15.1, 5.16.0-5.16.1, 5.16.6-5.17.0 |
| 5057785 | With more than 10k EVPN type 2 prefixes, there is a delay in convergence. | 5.14.0-5.15.1, 5.16.0-5.16.1, 5.16.6-5.17.0 |
| 5056914 | Optimized image upgrade to 5.15.x might consume space in the /var directory up to 2.2 times the image size and might not correctly check free space in /var before proceeding. | 5.14.0-5.15.1, 5.16.0-5.16.1, 5.16.6-5.17.0 |
| 5056845 | When you enable VRF leaking by manually attaching export RTs to the layer 2 VNI, the remote side ends up importing an EVPN type-2 route with an IPv6 link local address in the tenant VRF. These routes do not have a valid router MAC address, which is essential for layer 3 traffic forwarding in the tenant VRF and layer 3 VNI. | 5.16.0-5.16.1 |
| 5056648 | During the very fist linkup process, the port enters a CLOSE state and remains there because the micro-controller takes more time to respond. | 5.16.1, 5.16.6-5.17.0 |
| 5056426 | The switch transmits router advertisements on host-facing interfaces before 802.1X RADIUS authentication completes. | 5.16.6 |
| 5050916 | When LLDP proxy is enabled (EVPN unreachable-prefix in multiplane deployments), a host-facing interface that is administratively shut, or has carrier down and is then permanently removed from a tenant VRF might not send the LLDP proxy teardown flush to the host when the link later comes back up. Traffic might drop or reachability might be incorrect until the host is reset or the stale state is cleared. | 5.17.0 |
| 5045504 | After you enable BFD offload, BFD control packet counters stop incrementing. Control plane BFD sessions are not affected by this issue and there is no BFD functionality impact in case of kernel offload. | 5.16.0-5.16.1, 5.16.6-5.17.0 |
| 5041774 | ISSU upgrades with layer 3 VNIs can lead to a traffic drop because an incorrect RIF is programmed into hardware for all VRF based interfaces | 5.17.0 |
| 5041547 | When the /var directory runs out of disk space, the NVUE service goes down and you see the message NVUE Service temporarily unavailable. Please try again later. To work around this issue, restart the NVUE service after /var frees up. | 5.16.1, 5.16.6-5.17.0 |
| 5040890 | IPv4 BGP aggregate routes are not advertised to peers. | 5.14.0-5.15.1, 5.16.0-5.16.1, 5.16.6-5.17.0 |
| 5037464 | The gNMI /network-instances/network-instance[name]/protocols/protocol[identifier][name]/bgp/neighbors/neighbor[neighbor-address]/state/session-state metric intermittently returns no data. | |
| 5032793 | A timing issue allows a route marked for removal to still appear selected during EVPN type-5 re-advertisement. Because the EVPN advertisement path does not exclude removed paths, the route might leak and later avoid withdrawal after it becomes suppressed again. | 5.16.1, 5.16.6-5.17.0 |
| 5028864 | High Frequency Telemetry with warm boot fails. | 5.17.0 |
| 5027938 | Applying a 1x breakout (unsplit) on a port with connected optical modules might trigger an SDK or FW fatal event, leading to a cumulus-core core dump and a switchd failure. | |
| 5027914 | A BMC password reset reports Error: Invalid JSON format even though the BMC password change succeeds. | |
| 5025704 | When you set or change a password that contains a username, you see a misleading password validation error. | 5.17.0 |
| 5025459 | During FRR shutdown (reboot or upgrade), zebra might crash. There is no impact on normal switch operation or the data plane. The switch comes up cleanly after reboot. | 5.16.6-5.17.0 |
| 5024549 | The nv show router segment-routing srv6 stats command sometimes returns the error Error: SID 1389:4075::/32 is not configured. | 5.17.0 |
| 5024254 | When you apply an incorrect VLAN configuration to peer link bond member ports on the secondary MLAG switch, the MLAG peer link goes down and peer link member ports on both the primary and secondary MLAG switch go into a protodown state. The switch does not recover after NVUE rolls back the misconfiguration. To work around this issue (to restore the peer link and clear the protodown state), run the ifreload -a command or reboot the switch. | 5.16.1, 5.16.6-5.17.0 |
| 5022203 | When you disable TLVs in LLDP ingress policies, the TLV information still shows in neigbor data when the neigbor is already learned and the TLV provides chassis-level information, such as the system description or LLDP-MED Inventory. There is no impact on traffic. To work around this issue, restart the LLDP service with the sudo systemctl restart lldpd command. | 5.17.0 |
| 5019647 | If you do not configure 802.1x unsolicited EAP Identity Requests on an interface nv set interface , the default value shows only in the operational column. After you enable or disable unsolicited EAP Identity Requests on an interface, the value shows in both the applied and operational columns. | 5.17.0 |
| 5018860 | For an MBA authenticated session, the auth-type shows as unknown instead of MBA (MAC Based Authentication) in the gNMI XPath and OTEL metric output. | 5.17.0 |
| 5017654, 5041804 | On the NVIDIA SN6600-LD switch, 100G per lane is not supported. | |
| 5014229 | When you configure high BGP timers such as 60/180 and do a bulk route update (250k routes installed at the same time), the last updates stay stuck in BGP for an extended period of time and not installed in the FIB until BGP receives the next keep alive message. This impacts traffic for the prefixes that are not installed. | 5.17.0 |
| 5012235 | During BGP graceful restart, a helper router might retain and reinstall a stale IPv6 route learned from a restarting peer if the link to that peer flaps during the restart window. This issue affects IPv6 unicast routes that are carried over an IPv4 BGP session and resolved through a link-local next hop. IPv4 routes are not affected. | 5.17.0 |
| 5005534 | On the NVIDIA SN6600-LD switch with a high logical port count, generating a cl-support file takes approximately eight minutes with 64x8x breakouts. | |
| 5001357 | When you disable TLVs in LLDP ingress policies, the TLV information still shows in neigbor data when the neigbor is already learned and the TLV provides chassis-level information, such as the system description or LLDP-MED Inventory. There is no impact on traffic. To work around this issue, restart the LLDP service with the sudo systemctl restart lldpd command. | 5.17.0 |
| 4999022 | The SSH server inactive timeout does not close idle SSH sessions. | 5.16.1, 5.16.6-5.17.0 |
| 4996657 | On the Spectrum-3 switch, you might see changes in the lossy headroom extra threshold as a negative value. | 5.17.0 |
| 4990537 | After you run the nv action clear system link flap-protection violation command, the clear status does not show for each interface. This is a display issue and does not impact functionality. | 5.17.0 |
| 4988127 | Under certain conditions, AAA authentication restriction lockout attempts might not lock TACACS users out for failed REST API logins. | 5.17.0 |
| 4980039 | A narrow window condition occasionally occurs when the prometheus-sdk-stats service restarts while an HFT session is running. | 5.17.0 |
| 4968117 | When you configure an IPv6 link local address as the IPFIX destination, no IPFIX data is exported. | 5.17.0 |
| 4963562 | Uneven utilization of bond member links results in one member approaching congestion while the parallel member is largely idle. There is no traffic loss; the impact is bandwidth efficiency and potential micro-congestion on the overloaded member. | 5.11.5-5.15.1, 5.16.0-5.16.1, 5.16.6-5.17.0 |
| 4958116 | On the Spectrum-6 switch, when a telemetry stats-group has interface-stats export enabled but the PHY class disabled, PHY metrics (nvswitch_interface_phy_stats_* and nvswitch_interface_phy_layer_*) are still exported to the OTLP destination. NVUE shows PHY as disabled, but the export does not match. To work around this issue, disable PHY at the global telemetry interface-stats level. | 5.17.0 |
| 4957546 | With svi-force-up enabled, the SVI link state is unexpectedly NO-CARRIER and LOWERLAYERDOWN when all VLAN member ports are down. This results in loss of reachability to IP addresses configured on SVIs. To work around this issue, add and apply vlan-bridge-binding off to each SVI with a snippet; for example:
| 5.16.0-5.16.1, 5.16.6-5.17.0 |
| 4885068 | System wall-clock time modifications might cause a missed transceiver module temperature update resulting in reporting a 20C increase in temperature. | 5.16.1, 5.16.6-5.17.0 |
| 4881770 | On an 802.1x port with dynamic VRF enabled, the switch might not restore the port correctly to the configured VRF after the supplicant deauthenticates and the dynamic VRF is removed. To work around this issue and to restore the port VRF configuration correctly, run the sudo ifreload -a command after the supplicant is deauthenticated. | 5.16.0-5.16.1, 5.16.6-5.17.0 |
| 4796280 | When you delete a snippet with a NAS IP address and, or, a NAS identifier, the NVUE configured NAS IP address and NAS identifier do not take into effect in the operational configuration. | 5.16.0-5.16.1, 5.16.6-5.17.0 |
| 4771988, 4958439 | After you enable BFD offload, BFD control packet counters stop incrementing. Control plane BFD sessions are not affected by this issue and there is no BFD functionality impact in case of kernel offload. | 5.16.0-5.16.1, 5.16.6-5.17.0 |