If you are using the current version of Cumulus Linux, the content on this page may not be up to date. The current version of the documentation is available here. If you are redirected to the main page of the user guide, then this page may have been renamed; please search for it there.

Cumulus Linux 5.6 Release Notes

Download 5.6 Release Notes xls    Download all 5.6 release notes as .xls

5.6.0 Release Notes

Open Issues in 5.6.0

Issue IDDescriptionAffectsFixed
3782543
When you configure the BGP setting bgp max-med on-startup with vtysh, the MED on some peers might not be set to 4294967294 as expected on startup. The max-med might also fail to reset after the startup timer expires.5.6.0-5.8.0
3773177
When you try to upgrade a switch from Cumulus Linux 5.5 or earlier to 5.8.0 with package upgrade, you see errors for expired GPG keys that prevent you from upgrading. To work around this issue, install the new keys with the following commands, then upgrade the switch.
cumulus@switch:~$ wget https://download.nvidia.com/cumulus/apt.cumulusnetworks.com/repo/pool/cumulus/c/cumulus-archive-keyring/cumulus-archive-keyring_4-cl5.6.0u5_all.deb
cumulus@switch:~$ sudo apt install ./cumulus-archive-keyring_4-cl5.6.0u5_all.deb
cumulus@switch:~$ sudo apt update
cumulus@switch:~$ sudo apt upgrade
4.0.0-4.4.5, 5.0.0-5.8.0
3766994
Cumulus Linux 5.6 and 5.7 do not include FRR log rotation, which can result in a very large log file that affects disk usage. To work around this issue, run the following commands as the cumulus user on the Cumulus Linux 5.6 or 5.7 switch. The commands do not impact any other system function.
cumulus@switch:~$ wget https://download.nvidia.com/cumulus/apt.cumulusnetworks.com/repo/pool/cumulus/f/frr-logrotate/frr-logrotate_8.4.3-0+cl5.7.0u1_amd64.deb 
cumulus@switch:~$ dpkg –install frr-logrotate_8.4.3-0+cl5.7.0u1_amd64.deb
5.6.0-5.7.05.8.0
3751952
ifupdown2 tries to set the multicast database hash elasticity (bridge-hashel attribute) with a value of 4096. However, this attribute is now deprecated in the Linux kernel and the value is always 16.5.5.1-5.7.05.8.0
3739008
The Lenovo MSN4600-VS2RC (PN SSG7B27990 Back-to-Front/C2P Airflow) might run the fan tray fans at a high speed because the software believes the PSU fans are running in the wrong direction.5.5.1-5.8.0
3738626
If you configure a VNI before an SVI, you can’t add or remove the VRR address from the SVI. To work around this issue, configure the SVI before the VNI.5.6.0-5.7.05.8.0
3730904
When sending untagged frames to the CPU with an MTU higher than the SVD (single VXLAN device) MTU, the kernel might crash.5.4.0-5.8.0
3713419
When monitoring system statistics and network traffic with sFlow, an aggressive link flap might produce a memory leak in the sFlow service hsflowd.5.1.0-5.7.05.8.0
3712007
In RSTP mode when there is a bridge port flap, Cumulus Linux flushes, then re-adds dynamic MAC addresses on the peer link, which might cause short traffic disruption.5.6.0-5.7.05.8.0
3710396
In an eBGP multihop configuration with dynamic neighbors, Cumulus Linux does not update the configured TTL but uses the MAXTTL instead. This issue is only observed with dynamic peers.5.6.0-5.7.05.8.0
3702431
Traditional SNMP snippets do not take effect unless you first enable SNMP with the NVUE nv set service snmp-server enable on and nv set service snmp-server listening-address commands. Alternatively, you can use the equivalent REST API methods.5.4.0-5.8.0
3698680
If you run the ifreload -a command when ACLs exist but nonatomic update mode is set in the switchd.conf file, traffic pauses on unaffected interfaces.5.6.0-5.7.05.8.0
3696061
When the MAC address of a neighbor changes, the zebra IP routing manager might crash.5.2.1-5.8.0
3695430
When you configure extended nexthop encoding for a peer group, the peers in the group do not inherit the configuration. To work around this issue, configure extended nexthop encoding on each individual peer in the group. NVIDIA recommends that you upgrade to Cumulus Linux 5.6 or later to avoid this issue.5.4.0-5.8.0
3686389
When you use NVUE commands to configure an untagged VLAN (PVID) on a bridge to a non-default value, nv show bridge commands still indicate that the untagged VLAN is 1 (the default value). The untagged VLAN you configured is properly set on bridge ports, but displays incorrectly in operational NVUE show commands.5.6.0-5.7.05.8.0
3684998
DHCP lease information is not collected in the cl-support file.4.3.0-4.4.5, 5.0.0-5.8.0
3684268
When multiple interfaces have addresses in the same network, deleting one of them might cause the wrong connected route from being deleted.5.6.0-5.8.0
3671288
On rare occasions, when the BGP service receives multiple update messages due to multiple route churns in the network, the next hop might become unreachable during the time that the switch processes BGP updates and withdraws with EVPN prefixes. As a result, the EVPN neighbor might be missed in the kernel.5.6.0-5.7.05.8.0
3669935
When you add or delete VXLAN VNI and VLAN interfaces, a memory leak might occur in switchd.5.6.0-5.8.0
3668939
When you enable MIB 1.3.6.1.4.1.40310.1 in the snmpd.conf file, you might see high CPU usage by the snmpd service.5.5.1-5.8.0
3668809
SN2410 switches manufactured or sold by OEMs (not Mellanox) might contain fans that do not support system fan direction detection. As a result, the following messages occur in the log:
/usr/sbin/smond : : Path /run/hw-management/thermal/fan1_dir does not exist/usr/sbin/smond : : Path /run/hw-management/thermal/fan2_dir does not exist
smond has been modified to determine dynamically (at run-time) if the fan has the capability. To drop the messages before they get to the log, create a file, such as /etc/rsyslog.d/18-drop_fan_dir_msgs.conf with the following contents, then restart rsyslogd with the systemctl restart rsyslog command
# The lines below cause the offending message to be dropped from all logs:msg, ereregex, “.*Path /run/hw-management/thermal/fan[1-8]_dir does not exist” stop
5.6.0-5.8.0
3664986
If a core file is generated with a space in the name, Cumulus Linux generates cl-support files until the file is removed. To work around this issue, rename the core file without the space character. The next cl-support file generated will be moved into the cl-support archive and removed from the filesystem.5.6.0-5.8.0
3663182
Changing non-default BGP timers with NCLU or vtysh commands sets the hold time and keep alive interval to 0 seconds. To work around this issue, restart the FRR service with the sudo systemctl restart frr.service command.5.3.1-5.8.0
3662354
When you enable the FRR SNMP agent (agentx) and configure routing adjacencies with short timers (dead, keepalive, and hold time), the routing adjacencies might go down in certain scenarios; for example when you have frequent or concurrent client SNMP requests, you use custom SNMP MIB extensions, you poll OIDs with large responses, or during high CPU load. To work around this issue, you can increase the routing adjacency timers to accommodate SNMP processing.5.6.0-5.8.0
3655043
After you upgrade to Cumulus Linux 5.6.0 with package upgrade, configuration changes you make with NVUE commands do not apply and you see the error message Invalid config [rev_id: 4] Default profile parameters can not be modified. Modification allowed on user created profiles. To workaround this issue:1. Remove the PTP configuration using the nv unset service ptp 1 enable syntax
2. Save the configuration nv config apply. 3. Re-add the PTP config. Note: this procedure results in a switchd restart which will have an impact on the data plane.
5.6.0-5.8.0
3655027
If you create a new snippet with the same name as a snippet you deleted, you receive a warning message. To work around this issue, create the new snippet with a different name than any removed snippets.5.6.0-5.8.0
3650661
Configuration changes to an already applied custom flexible snippet that includes a service restart does not restart the service when you apply the patch.5.6.0-5.8.0
3646119
If you have VRFs configured and you change the global ASN in FRR, BGP crashes. To work around this issue, don’t unset more than one BGP instance at a time if one of the router bgp instances has VRF leaking configured.5.6.0-5.8.0
3644473
When bulk interface flaps trigger, Cumulus Linux does not process the route.route_preferred_over_neigh=both configuration correctly due to the sequence of the events that occur when switchd creates and processes the route or neighbor and nexthop group.5.6.0-5.8.0
3643624
The help text for the NVUE policer command nv set acl rule action police mode incorrectly indicates that the policer mode units are in bits per second. NVUE configures policers using bytes per second.5.6.0-5.8.0
3639058
When you run the nv show service ntp command, you see an error message instead of the expected output.5.6.0-5.8.0
3632843
When the switch receives a type-5 route in BGP and there is a network statement for the same prefix, BGP sometimes removes the request to track next hops from FRR. As next hop reachability changes, BGP no longer reacts to the change. To work around this issue, run the clear bgp * command for all peerings.5.6.0-5.7.05.8.0
3630492
On the NVIDIA SN2201 switch, the ledmgrd -d command output shows the system and PSU LED status as orange when the physical LED is green.5.5.1-5.7.05.8.0
3627913
The switch drops untagged VLAN traffic on single VXLAN bridge ports.5.6.0-5.8.0
3616643
NVUE commands to set a route map exit policy match produce incorrect configuration in the /etc/frr/frr.conf file.5.6.0-5.8.0
3616338
When you reboot an MLAG switch with 3000 or more VNIs, there might be extended traffic loss during reboot. To work around this issue, configure the clagd service initDelay to 300 seconds with the nv set mlag init-delay 300 command.5.5.1-5.8.0
3614286
To avoid unnecessary traffic loss, ifreload (ifupdown2) only flaps a bond to reset its MAC address when the bond MAC address is not present on any of the bond’s interfaces. Previously, ifupdown2 enforced the bond MAC address to be set to the MAC address of the first interface.5.6.0-5.7.05.8.0
3613258
With VM migration from one VTEP to another, traffic loss might occur during a MAC move as locally learned MAC addresses are frequently refreshed between switchd and the kernel.5.2.1-5.8.0
3612959
The interface name for a VLAN subinterface does not show correctly; the VLAN is appended to the interface again.5.6.0-5.8.0
3611215
In an EVPN multihoming configuration, the switchd service produces error messages similar to the following:
2023-09-07T15:45:56.055477+02:00 switch1 switchd7903: hal_mlx_flx_acl.c:2388 hal_mlx_flx_region_pull_bulk_counters failed
These error messages do not affect how the switch functions; however the messages fill up the switchd logs, which is not desirable.
5.6.0-5.8.0
3610967
In an EVPN symmetric routing configuration, running the NVUE nv set vrf vlan auto command to derive layer 3 VNIs automatically might result in duplicate VLAN entries in the system. This most often occurs at scale when many VRFs have similar names. To work around this issue, manually specify a unique VLAN for each VRF.5.3.0-5.8.0
3610611
Cumulus Linux assigns an IPv4 and IPv6 loopback address to a VRF interface by default. As a result, ping and route lookups for unique remote IP addresses on different VTEPs might not work if there is no source IP on the switch that belongs to the same subnet. To work around this issue, remove the loopback address on the VRF with the nv unset vrf loopback ip address command. Only remove the loopback address if you are not running NTP as NTP requires a loopback address to work. Alternatively, you can change the ping command to use a source address (such as an SVI address) with the ip vrf exec ping <REMOTE_IP> -I <SVI_SRC_IP> command.5.5.0-5.8.0
3609128
When you use vi with root or sudo, visual mode is enabled by default due to a missing vimrc configuration file. This makes it difficult to copy and paste into vi. In CL5.7.0, the default configuration now includes set mouse-=a
In addition, the CL5.7.0 default configuration for vi now disables modelines, which can be a security risk.
5.5.0-5.8.0
3608014
Software MAC learning might not work for a bridged VLAN subinterface on a bond (such as bond1.100) if you remove a VLAN subinterface completely from the configuration, then add it back with an identical configuration. To work around this issue, restart switchd.5.6.0-5.8.0
3606739
The thermal control service, hw-management-tc.service, stops and switch fan speeds run at 100% when the ASIC temperature can’t be read. This can occur if the SDK is not started.5.5.1-5.8.0
3603237
If the secondary MLAG peer continuously reboots, you might experience momentary traffic loss.5.5.1-5.8.0
3600588
You can’t reset the root password by booting into Cumulus Linux single-user recovery mode. To work around this issue, follow the steps in https://docs.nvidia.com/networking-ethernet-software/cumulus-linux-56/Monitoring-and-Troubleshooting/Single-User-Mode-Password-Recovery/.5.6.0-5.8.0
3599699
Cumulus Linux assigns an IPv4 and IPv6 loopback address to a VRF interface by default. As a result, ping and route lookups for unique remote IP addresses on different VTEPs might not work if there is no source IP on the switch that belongs to the same subnet. To work around this issue, remove the loopback address on the VRF with the nv unset vrf loopback ip address command. Only remove the loopback address if you are not running NTP as NTP requires a loopback address to work. Alternatively, you can change the ping command to use a source address (such as an SVI address) with the ip vrf exec ping <REMOTE_IP> -I <SVI_SRC_IP> command.5.5.0-5.8.0
3597456
NVUE does not allow you to use the reserved name lo in an interface name.5.5.1-5.8.0
3590394
Under rare conditions, running NVUE commands that capture output larger than 4k bytes from Linux tools or utilities might result in failures with 500 INTERNAL SERVER ERROR or Unrecoverable internal error messages. This issue occurs when there are non-ascii characters in large outputs that Cumulus Linux can’t decode. This failure is observed only in Cumulus Linux 5.6 and earlier.5.6.0-5.8.0
3587393
If you use the NVIDIA SN5600 (Spectrum-4) switch with Ixia test equipment, you might experience delayed link up due to intermittent link flaps.
To work around this issue when using copper cables:
  • Use Ixia IxOS version 9.37 with HF002156, or version 9.39 or later.
  • Use the DAC cable on ports 10 through 50.
  • Use NVIDIA cables with the recommended firmware revision.
  • Configure AN on the Cumulus Linux switch and AN/LT on Ixia.

To work around this issue when using fiber cables:
  • Configure 800g/Force.
  • Use the recommended NVIDIA optical adapters.
5.6.0-5.8.0
3585467
NVUE and ip link show traditional bridge VLAN subinterface counts incorrectly. The ingress (Rx) count increments correctly but the egress (Tx) count does not increment. This issues occurs because the hardware does not support transmit counters for a VLAN subinterface; therefore, no statistics from the hardware are updated. Statistics for software forwarded packets show correctly.5.0.0-5.8.0
3582826
When you enable the FRR SNMP agent (agentx) and configure routing adjacencies with short timers (dead, keepalive, and hold time), the routing adjacencies might go down in certain scenarios; for example when you have frequent or concurrent client SNMP requests, you use custom SNMP MIB extensions, you poll OIDs with large responses, or during high CPU load. To work around this issue, you can increase the routing adjacency timers to accommodate SNMP processing.5.5.0-5.8.0
3580435
On the NVIDIA SN2410 switch with an Innodisk SSD, you might see the following message in syslog:
smartd[501]: Device: /dev/sda [SAT], CHECK POWER STATUS spins up disk (0x00 -> 0xff)
This is a cosmetic issue and does not affect how the switch operates. To prevent this message from occurring, run the hdparm -S 24 /dev/sda command to change the HD timeout.
5.3.1-5.8.0
3576961
The NVUE command to clear all ACL counters at once is not available. To work around this issue, run the cl-acltool -Z all command to reset the statistics for all ACL rules.5.5.1-5.8.0
3576949
When you run the NVUE nv set service snmp listening-address localhost vrf or nv set service snmp listening-address localhost-v6 vrf command to configure the SNMP listening address, Cumulus Linux applies the listening address to the default VRF instead of the VRF you specify.5.3.0-5.8.0
3575800
When you configure the peerlink interface with NVUE but do not configure the necessary MLAG parameters with nv set mlag commands (such as the backup IP address, peer IP address, and MLAG MAC address), NVUE apply fails with the following message:

MLAG cannot be deleted when a peerlink or peerlink sub-interfaces exist
5.6.0-5.8.0
3573800
After you apply a change to the router MAC address on an SVI with the ifreload -a command, the old router MAC address still remains in the FDB table. To work around this issue, remove the old router MAC address with the sudo bridge fdb del <old_mac> dev bridge vlan <vlan_id> command.5.3.1-5.8.0
3567708
In an EVPN multihoming environment with VRRP, when the master VRRP router fails, the standby router takes around 30 seconds to become active.5.3.1-5.8.0
3566980
When running DHCP relay for IPv6 and a downstream interface flaps more than once, relaying might stop working. To recover, restart the dhcrelay6 service, making sure the specified downstream interfaces are up and running.5.5.0-5.8.0
3556762
On rare occasions, SPT switchover might not happen cleanly in PIM resulting in some dropped packets. If you use PIM-SM to replicate EVPN BUM traffic, you might see a brief drop of multicast traffic before recovering due to normal PIM-SM traffic timeout.5.5.0-5.8.0
3554231
None
CVE-2023-38408: The PKCS#11 feature in ssh-agent in OpenSSH before 9.3p2 has an insufficiently trustworthy search path, leading to remote code execution if an agent is forwarded to an attacker-controlled system. (Code in /usr/lib is not necessarily safe for loading into ssh-agent.) NOTE: this issue exists because of an incomplete fix for CVE-2016-10009
Mitigation: Do not use ssh-agent forwarding (the man page for ssh_config says that “agent forwarding should be enabled with caution”), or start the ssh-agent program with the -P option to allow only specific PKCS#11 libraries (or none with -P ‘')
For Cumulus Linux 4.3.2, the /usr/bin/ssh-agent program has all permissions turned off (chmod 0) to prevent its execution if a vulnerable version is detected.
4.0.0-4.3.1, 5.0.0-5.8.04.3.2-4.4.5
3549798
If you add a VRF, then SSH into that VRF, which is a generated service (for example, sshd@vrfname.service), the service fails as the VRF is not created in time. To work around this issue, configure the VRF first, apply the configuration, then enable the SSH service on the VRF.5.6.0-5.8.0
3538321
In rare cases, an STP topology change on PTP over a VLAN can result in the switch losing the slave state and one of the ports might remain in an uncalibrated state. To work around this issue, toggle the port that is in the uncalibrated state up and down so that one of the ports is selected as the slave.5.6.0-5.8.0
3534718
The BGP command to suppress longer prefixes inside the aggregate address before sending updates (nv set vrf router bgp address-family aggregate-route
summary-only or vtysh router bgp aggregate-address
summary-only) does not suppress more specific routes from being exported into the EVPN routing table and advertised as EVPN type-5 routes. To work around this issue, announce EVPN type-5 routes by adding an additional outbound policy or export policy to filter out the more specific routes.
5.5.0-5.8.0
3533272
If you set an OSPF network and define the subnet using a host address (such as 10.1.1.2/24) instead of the (starting) subnet network address (such as 10.1.1.0/24), you can’t unset the prefix with the nv unset vrf default router ospf area network command. Avoid defining the subnet using a host address when setting an OSPF network.5.6.0-5.8.0
3522524
FRR does not allow eBGP multi hop configuration on unnumbered BGP neighbors.5.5.0-5.8.0
3517739
When you connect the SN5600 switch to third party test equipment (such as IXIA) using copper cables, 100G, 200G, 400G, and 800G links do not come up. To work around this issue, use fiber optic cables when testing an SN5600 switch with IXIA for 100G, 200G, 400G, and 800G link speeds.5.6.0-5.8.0
3484058
When you power on the NVIDIA SN3420 switch with no connected cables, the QSFP ports LEDs light in amber.5.3.0-5.8.0
3463827
On rare occasions, SPT switchover might not happen cleanly in PIM, resulting in some dropped packets. If you use PIM-SM to replicate EVPN BUM traffic, you might see a brief drop of multicast traffic before recovering due to normal PIM-SM traffic timeout.5.6.0-5.8.0
3452732
The nv set router policy ext-community-list rule ext-community rt command does not generate the standard based BGP community list. As a result, routes do not match the expected community list. To work around this issue, create a snippet to add the policy configuration to the /etc/frr/frr.conf file, then patch the configuration. For example:
cumulus@switch:~$ sudo nano frr_policy.yaml- set:
system:
config:
snippet:
frr.conf: |
bgp extcommunity-list standard EXTCOMMUNITY1 seq 10 permit rt 65102:10
cumulus@switch:~$ nv config patch frr_policy.yaml
5.5.0-5.8.0
3452681
When you run the NVUE nv show system aaa tacacs authorization commands to show per command authorization for a specific TACACS+ user privilege level, you see an error message similar to Error: GET /nvue_v1/system/aaa/tacacs/authorization/1?rev=operational responded with 404 NOT FOUND.5.5.0-5.8.0
3445841
FRR does not apply Type-0 ESI configuration for EVPN multihoming bonds consistently after an FRR service reload. This issue occurs because the system MAC address value (es-sys-mac) is only compatible with a 3-byte Ethernet segment ID (es-id) for Type-3 ESIs, but still renders even when the Ethernet segment ID is 10 bytes for Type-0 ESIs. To work around this issue, configure EVPN multihoming bonds with a Type-3 ESI (es-sys-mac plus a 3-byte es-id).5.0.0-5.8.0
3433577
When you use a single VXLAN device (SVD) with MLAG and static VXLAN tunnels, Cumulus Linux incorrectly associates the MAC addresses it learns from the VXLAN fabric to the bridge PVID. This issue can lead to a feedback loop between the clagd service and switchd, and might result in critical CPU usage with an out of memory condition. Do not use an SVD when enabling MLAG in a static VXLAN environment.5.5.0-5.8.0
3428677
In certain cases, Cumulus Linux does not process next hop updates because the zebra IP routing manager thinks the state of the next hops is unchanged. As a result, route installation fails and remains in a rejected state.5.3.0-5.8.0
3424967
sudo for TACACS+ users with privilege level 15 does not work when reaching the TACACS+ server through the default VRF. To work around this issue, specify the interface name that the default VRF uses in the vrf= setting of the /etc/tacplus_servers file or run the NVUE nv set system aaa tacacs vrf command. If you don’t run either command, a TACACS+ user with privilege level 15 can run vrf task exec default sudo … to execute the sudo command.5.0.0-5.8.0
3420056
The ADVA 5401 SFP module with hardware revision 5.01 does not come up at layer 1 when you use 10G QSA adaptors. To work around this issue, use 25G QSA adaptors.4.4.0-4.4.5, 5.0.0-5.8.0
3419928
The NVUE PIM timer command option names keep-alive and rp-keep-alive are inconsistent and need to change to keepalive and rp-keepalive.5.4.0-5.8.0
3405024
You cannot remove PBR map configuration with source and destination rules. To work around this issue, delete the entire PBR map clause.5.5.0-5.8.0
3393966
Configuring the network statement with the NVUE nv set vrf router ospf area network command might bring down all the OSPF neighbors. To work around this issue, create an NVUE snippet to configure the network statement.5.5.0-5.8.0
3368217
None
When daylight saving time changes, the MLAG initDelay timer resets and all MLAG bonds go down.4.4.4-4.4.5, 5.2.1-5.8.0
3362113
If you restore an NVUE startup.yaml file or run the nv config patch command after an upgrade that includes breakout ports with QoS configuration, the NVUE configuration fails to apply. Subsequent attempts to run nv config apply fail with a message similar to Invalid config [rev_id: 11] qos config is not supported on the following invalid interface: swp1s0. Supported on swp and bond interface types. To work around this issue, run nv unset on the configured QoS settings, then apply the breakout port configuration before you configure QoS. Alternatively, you can remove the QoS configuration from the yaml file and patch it separately after applying the breakout configuration.5.4.0-5.8.0
3350027
If you uninstall dynamic NAT rules and switchd restarts before all the dynamic NAT flows age out and are deleted, you might see dynamic flow deletion errors in switchd.log. These errors do not affect new dynamic NAT flows from new NAT rules.5.4.0-5.8.0
3347677
In an MLAG configuration, when a link failure occurs on the peerlink or the peerlink shuts down, the switch in the secondary role attracts traffic to its local VTEP as it advertises the local VTEP IP address momentarily just before the VXLAN device is protodown. This traffic is dropped for a brief moment (between 5 and 10 seconds) because the MLAG bonds on the secondary switch are already protodown.5.1.0-5.8.0
3347538
When connecting NVIDIA-to-NVIDIA in PAM4, you must enable auto-negotiation.5.4.0-5.8.0
3345054
The NVUE nv show interface qos command takes a significant time to show output or times out. To work around this issue, use specific QoS commands. For example, to show congestion control information, run the nv show interface qos congestion-control command.5.4.0-5.8.0
3341214
If you use the NVUE REST API to configure a local user with a hashed password, the user cannot log in and the /etc/nvue.d/startup.yaml file shows the password as plain text.5.4.0-5.8.0
3334275
When you run the sensors command, the output shows an erroneous fault on some front panel ports.5.2.0-5.7.05.8.0
3329518
When using TACACS+, if the /etc/nsswitch.conf file specifies passwd: files tacplus (files is listed before tacplus), a user that is present in both the local /etc/passwd file and the TACACS+ server cannot log into the switch. NVIDIA recommends that when using TACACS+, you list tacplus before files in /etc/nsswitch.conf. When using NVUE, ensure that tacacs has priority over local.5.4.0-5.8.0
3327477
If you use su to change to a user specified through TACACS+, the user becomes the local tacacs0 thru tacacs15 user instead of the named user to run sudo commands. As a result, the named user password might not match the local tacacs0 thru tacacs15 user password.3.7.0-3.7.16, 4.0.0-4.4.5, 5.0.0-5.8.0
3326659
If you have a large number of MAC addresses, they do not age out at the MAC ageing timeout value configured on the switch. It might take up to 30 seconds more for the MAC addresses to age out and be deleted from the hardware. To work around this issue, wait for the ageing timeout value plus 30 seconds.5.4.0-5.8.0
3266197
When you disable BGP globally with the nv set router bgp enable off command, applying the configuration with NVUE might fail due to an FRR reload failure.5.2.0-5.8.0
3264269
When you change the BGP router ID that causes a change to an EVPN VNI RD, EVPN EAD-per-EVI routes are not updated properly.5.3.0-5.8.0
3258232
If you use NVUE to configure multiple SNMP listener addresses at the same time, the SNMP service fails to start. To work around this issue, configure multiple SNMP listener addresses one at a time.5.3.0-5.8.0
3241567
When you apply switch configuration for the first time on a freshly booted switch and you run the nv config apply command after setting the hostname with nv set system hostname, you might see the error message Failed to start Hostname Service. To work around this issue, run the nv config apply command a second time.5.3.0-5.8.0
3232091
The NVUE nv unset interface link lanes command does not restore the port lane setting to the default value. To work around this issue, run the nv set interface link lanes command.5.4.0-5.8.0
3226506
The l1-show eth0 command does not show port information and is not supported in this release.5.3.0-5.8.0
3221628
Cumulus Linux VX images might include an incorrect entry at the end of /etc/apt/sources.list, which produces warnings when you run apt update. Remove this entry to avoid these warnings.5.2.0-5.8.0
3172504
When you connect the NVIDIA SN4600C switch to a Spectrum 1 or Spectrum-3 switch with a 40GbE passive copper cable (Part Number: MC2210126-005) on edge ports 1-4 and 61-64, there is an Effective BER of 1E-12 in PHY.5.2.0-5.8.0
3147782
You cannot use NVUE to configure an SNMP view to include a subtree beginning with a period. For example:
cumulus@switch:~$ nv set service snmp-server viewname cumulusOnly included .1.3.6.1.4.1.40310Error: GET /nvue_v1/service/snmp-server/viewname/cumulusOnly/included?pointers=%5B%22%2Fparameters%22%2C+%22%2Fpatch%2FrequestBody%2Fcontent%2Fapplication~1json%2Fschema%22%2C+%22%2Fpatch%2Fparameters%22%2C+%22%2Fpatch%2Fresponses%2F200%2Flinks%22%5D responded with 404 NOT FOUND
To work around this issue, reference the OID without the preceding period ( . ) in the command.
5.3.0-5.8.0
3145869
On a Spectrum-3 switch, the PTP offset in 10GbE changes between +-27. The average offset is around 7.5.2.0-5.8.0
3141826
A slow memory leak (~5KB over 24 hour period at a 60 second polling interval) might occur in SNMP when you walk the following system MIB objects (1.3.6.1.2.1)
1.3.6.1.2.1.47 –> Entity MIB
1.3.6.1.2.1.99 –> Entity Sensor MIB
1.3.6.1.2.1.23 –> rip2
1.3.6.1.2.1.2 –> interface/interfaces
1.3.6.1.2.1.31 –> ifMIB
1.3.6.1.2.1.4 –> IP
1.3.6.1.2.1.25 –> hostResource
5.0.1-5.8.0
3135952
PAM4 split cables (such as 2x100G, 4x100G, and 4x50G) do not work with a forced speed setting (when auto-negotiation is off) as the default speed enabled is for NRZ mode (such as 100G_4X). To work around this issue, set the appropriate lanes for forced speed (with auto-negotation off) with the ethtool -s swpX speed <port_speed> autoneg off lanes <no_of_lanes> command. For example:
cumulus@switch:~$ sudo ethtool -s swp1 speed 100000 autoneg off lanes 2
5.2.0-5.8.0
3122301
On the NVIDIA SN4700 switch, inserting and removing the PSU might cause loss of frames.5.2.0-5.8.0
3115242
When you configure two VNIs in the same VLAN, ifupdown2 shows a vlan added to two or more VXLANS warning, which is only issued after the VNI is already added to the bridge. This leaves the new VNI in the PVID even if there is already an existing VNI configured in that PVID.5.1.0-5.8.0
3103821
On the NVIDIA SN4700 switch, inserting and removing the PSU might cause loss of frames.5.2.0-5.8.0
3084476
After you disable traffic shaping in the /etc/cumulus/datapath/qos/qos_features.conf file, the default QOS traffic shaping configuration does not restore. To work around this issue, restart switchd.4.4.3, 5.0.0-5.8.04.4.4-4.4.5
3084027
Under a high load, you might see ingress drop counters increase. The drops are classified as HwIfInDiscards in ethtool and shown as ingress_general in hardware.4.3.0-4.4.5, 5.0.0-5.8.0
3071652
On rare occasions, after you reboot or restart switchd on a Spectrum 1 switch, any 25G connections with Direct Attach Copper (DAC) cables that connect from the switch to a non-NVIDIA device might flap continuously. To work around this issue, bring the affected link administratively down for a few seconds on the non-NVIDIA device, then bring the link back up.4.4.4-4.4.5, 5.1.0-5.8.0
3061656
When the CPU load is high during a warm boot, bonds with a slow LACP rate fail to forward layer 2 traffic for up to 60 seconds (depending on the duration of the CPU load) and static bonds fail to forward layer 2 traffic for up to 5 seconds.5.1.0-5.8.0
3053094
When the CPU load is high during a warm boot, bonds with a slow LACP rate fail to forward layer 2 traffic for up to 60 seconds (depending on the duration of the CPU load) and static bonds fail to forward layer 2 traffic for up to 5 seconds.5.1.0-5.8.0
2972540
With RADIUS enabled for user shell authentication, there might be a delay in local user authentication for non cumulus user accounts.5.0.0-5.8.0
2964279
When a VNI flaps, an incorrect list of layer 2 VNIs are associated with a layer 3 VNI. The NCLU net show evpn vni detail command output shows duplicate layer 2 VNIs under a layer 3 VNI.3.7.15, 4.4.2-4.4.5, 5.0.0-5.8.03.7.16
2951110
The net show time ntp servers command does not show any output with the management VRF.3.7.15-3.7.16, 4.1.1-4.4.5, 5.0.0-5.8.0
2904450
When you run the ethtool -m or the l1-show command, the 400G interface optical values do not show.4.4.0-4.4.5, 5.0.0-5.8.0
2891255
CVE-2021-39925: Buffer overflow in the Bluetooth SDP dissector in Wireshark 3.4.0 to 3.4.9 and 3.2.0 to 3.2.17 allows denial of service via packet injection or crafted capture file.
Vulnerable: <= 2.6.20-0+deb10u1
Fixed: 2.6.20-0+deb10u2
4.0.0-4.4.1, 5.0.0-5.8.04.4.2-4.4.5
2890681
CVE-2021-42771: relative path traversal in Babel, a set of tools for internationalising Python applications, could result in the execution of arbitrary code
Vulnerable: 2.6.0+dfsg.1-1Fixed: 2.6.0+dfsg.1-1+deb10u1
4.0.0-4.4.1, 5.0.0-5.8.04.4.2-4.4.5
2867042
When connecting the NVIDIA SN4600 switch to another NVIDIA Spectrum switch, you must use auto-negotiation mode (not force mode); otherwise the switch might use the wrong Tx configuration.5.0.0-5.8.0
2847755
When you use NCLU to remove the configuration for a peer that is a member of a group but also has other peer-specific configuration, you must remove the peer-specific configuration before you delete the peer in a separate NCLU commit.5.0.0-5.8.0
2823307
Cumuls Linux does not support a bond with more than 64 ports. Any configuration with more than 64 ports in a bond changes all ports to down when you apply the configuration.5.0.0-5.8.0
2736108
When you change the VRRP advertisement interval on the master, the master advertisement interval field in the show vrrp command output does not show the updated value.4.4.0-4.4.5, 5.0.0-5.8.0
2705056
When configured with NVUE, SVIs do not inherit the pinned MAC address of the bridge.4.3.0, 5.0.0-5.8.04.3.1-4.4.5
2684925
The NVUE nv show vrf default router bgp peer command produces a 404 not found error.4.4.0-4.4.5, 5.0.0-5.8.0
2671652
In VXLAN routing environments, you might experience sub-optimal route convergence delays (longer than five seconds) when a prefix transitions to a new ECMP next-hop group. This condition might occur when a VTEP loses ECMP routes through all uplink peerings, then installs the routes through a different path, such as an MLAG peerlink.4.4.0-4.4.5, 5.5.0-5.8.0
2543915
CM-26301
When you enable a service in the management VRF, systemctl issues a warning similar to the following:
Warning: The unit file, source configuration file or drop-ins of ntp@mgmt.service changed on disk. Run ‘systemctl daemon-reload’ to reload unit
You can safely ignore this warning.
4.0.0-4.4.5, 5.0.0-5.8.0

Fixed Issues in 5.6.0

Issue IDDescriptionAffects
3715651
If you run NVUE commands to configure PIM for a VRF before you create the VRF, PIM does not create the pimreg device and the pimd service crashes.5.5.1
3695541
When applying a full configuration with NVUE that includes VRRP and BGP in VRFs, the VRRP configuration does not come up after you run nv config apply. BGP routes might also be missing. This issue only happens during the initial nv config apply of a full configuration, not during a normal initialization during a reboot or FRR restart. To work around this issue, reboot or restart FRR.5.5.1
3647426
None
If BGP remote-as is set to an integer and you try to configure the local-as for a BGP instance, you see the following error:
% AS specified for local as is the same as the remote as and this is not allowed
This configuration is not allowed; it is considered to be eBGP and local preference is not advertised.
5.0.0-5.5.1
3572580
You cannot set a VLAN match and a MAC protocol IPv4 match in a MAC type ACL rule. To apply ACLs with a VLAN match and layer 3 header matches ( IPV4/IPV6), you need to use type ipv4 or ipv6 ACLs with the VLAN match specified.5.5.1
3572566
The NVUE nv action commands are missing from nv list-commands output.5.5.1
3560622
When you configure a route distinguisher (RD) or a route target (RT) manually for layer 2 VNIs, type-1 routes are not properly updated, type-1 EVI routes with the old RD are not properly withdrawn, and type-1 ES routes do not have the corresponding layer 2 VNI route target updated.5.0.0-5.5.1
3549138
In an EVPN environment with ARP suppression enabled, when a host sends a unicast ARP request to a remote host, the ARP reply is duplicated. It is replied once by the remote host and once by the VTEP.5.5.0-5.5.1
3541912
Collecting a cl-support file in a high VNI and interface environment can result in an out-of-memory (OOM) event on the switch. An OOM event can cause critical services to restart and might impact traffic.5.1.0-5.5.1
3541518
When you remove the update-source configuration for a BGP neighbor, the peering is reset if the neighbor is a member of a peer group with the same update-source configuration.5.5.0-5.5.1
3538497
In an EVPN symmetric routing configuration, after rebooting a switch that uses VLAN 1 for a layer 3 VNI, traffic forwarding for VLAN 1 fails. To work around this issue, restart the FRR service with the sudo systemctl restart frr.service command.5.5.0-5.5.1
3528359
A switchd assertion crash occurs after KVD resource exhaustion in the SDK because entries are in a pending delete state, which causes an ECMP allocation failure.5.5.0-5.5.1
3526004
For layer 3 VNIs, Cumulus Linux automatically creates an SVI name that includes an underscore (for example, vlan4036_l3), which is not allowed in SVI names. As a result, commands such as nv show interface for the SVI show an error. The underscore (_) character is now allowed in SVI names.5.5.0-5.5.1
3520511
If you apply EVPN multihoming configuration such as es-df-pref, es-id and es-sys-mac with vtysh after you remove a bond interface that is part of a bridge and run ifreload -a, FRR crashes. To work around this issue, do not remove a bond from a bridge before you configure EVPN multihoming with vtysh.5.5.1
3517376
When you use CMIS specification based optics, the l1-show command output provides incorrect values for digital diagnostics (TX Power and RX Power). To work around this issue, run the mlxlink command with either the -m or –cable –ddm flags.5.5.0-5.5.1
3509445
If a BGP numbered session is in a non-established state, SNMP walk commands to the system might time out when the BGPVRF MIB is included in the OIDs to collect. In addition, FRR might report warnings about AgentX in the log files.5.5.0-5.5.1
3498939
In an EVPN environment, VM migration (IP and MAC address migration) might not work because the new local VTEP to which the VM migrates does not install the entry in the kenel. To work around this issue, restart the switchd service.5.4.0-5.5.1
3496931
When you update a prefix list associated with an RP, the pimd service might crash if the prefix list exists without any prefixes. To work around this issue, ensure that any prefix list associated with an RP includes at least one prefix at all times.5.3.1-5.5.1
3496889
When PTP is not enabled on the switch, NVUE nv show ptp commands freeze. This might cause other NVUE commands to fail and the NVUE service to restart.5.3.1-5.5.1
3495630
The NVUE nv show service ptp current command output shows an incorrect value. To work around this issue, run the nv show service ptp monitor timestamp-log command or the Linux pmc utility.5.3.1-5.5.1
3491259
When BGP receives an EVPN type-5 route with a gateway IP overlay attribute, the gateway IP overlay attribute in the attr memory (which is already inserted in the attribute hash) might change. As a result, the modified attr memory might match with another attr in the attribute hash, which produces duplicate entries in the hash table. As a result, BGP might crash when deleting one of the duplicate attr structures.5.0.0-5.5.1
3488136
When zebra receives route updates that include both a route with a recursive next hop and the route used to resolve that next hop, zebra might mark the route with the recursive next hop as inactive. To work around this issue, reprocess the route updates by running the appropriate clear command for the protocol in use. For example, for BGP, clear inbound routes from the relevant neighbor using the nv action clear vrf router bgp neighbor address-family in command.4.2.1-5.5.1
3486102
SNMP and TACACS secrets are shown in cleartext.5.5.0-5.5.1
3482006
None
If FRR learns a layer 2 entry against a VNI and you reconfigure the VNI later as a layer 3 VNI, the original layer 2 entry does not clear and remains in the forwarding database.4.3.0-4.3.1
3479786
The switchd service does not handle certain route and next hop updates, which causes a synchronization loop. For example, in a VRF route leaking configuration, where a next hop group spans across multiple VRFs, when one of the routes is withdrawn and the next hop is no longer used, switchd has problems synchronizing other next hops in the group
To work around this issue, disable next hop groups in zebra with the vtysh zebra nexthop proto only command, and then reboot the switch.
5.3.0-5.5.1
3474427
On rare occasions, LLDP and other CPU originated IP packets that egress a port might get replicated in the data plane and forwarded out of another port as well. The peer node might discard the unicast packets on the wrong port because of the destination MAC address; however, there might be problems with multicast packets, such as LLDP, which uses a multicast MAC address as the destination MAC address. To work around this issue, reboot the switch.
3474391
The SNMP MIB definition file /usr/share/snmp/mibs/Cumulus-BGPVRF-MIB.txt does not define the INDEX of the bgpPeerEntry correctly. This issue does not impact SNMP functionality for this MIB.4.3.1-5.5.1
3472865
The json output for the vtysh -c ‘show bgp all json command is missing a string key in front of the list of routes under the l2vpnevpn address family.5.4.0-5.5.1
3471052
On certain QSFP-DD and OSFP optical modules, the ethtool -m command, and the related NCLU and NVUE commands that display optical module information fail.5.4.0-5.5.1
3470941
None
On the NVIDIA SN4700 switch, reversing the upper four lanes on a port does not work and might cause link degradation. If you swap the upper and lower four lanes on a port, the firmware gets stuck.5.3.0-5.5.0
3467890
BGP aggregate routers are not advertised after learning the same route from another protocol. To work around this issue, restart the FRR service or, if possible, don’t learn the route from another protocol (use route maps instead).5.3.0-5.5.1
3466703
In rare cases when there is high load, the clagd service might experience a buffer overflow and MLAG bonds stay in a proto-down state on the secondary switch. You see a “NetlinkThread: Netlink overflow” log message and the MLAG state indicates VLAN conflicts between peers. To work around this issue, restart the clagd service with the sudo systemctl restart clagd command on the switch that reports the overflow log message.5.2.0-5.5.1
3459696
If you run the NVUE nv show vrf router bgp peer-group command when the BGP instance is not enabled, you see an NVUE traceback error.5.4.0-5.5.1
3459460
On certain QSFP-DD and OSFP optical modules, the ethtool -m command, and the related NCLU and NVUE commands that display optical module information fail.
3455078
When you bring down or delete a bridge or all interfaces on the switch, you see the following error message in the /var/log/switchd.log file:
ERR bridge destroy for vlan  bridge_id  vfid  failed: Resource is in use
The errors are temporary and have no impact on functionality or traffic.
5.5.0-5.5.1
3452763
When you use the NVUE API with TACACS+, users might see a 403 Forbidden message if no TACACS+ user has logged in some other way, such as with SSH. To work around this issue, log in any TACACS+ user through SSH before you use the NVUE API with TACACS+ users, or run the following commands:
cumulus@switch:~$ sudo touch /run/tacacs_client_map
cumulus@switch:~$ sudo chown root:shadow /run/tacacs_client_map
cumulus@switch:~$ sudo chmod 0644 /run/tacacs_client_map
5.5.0-5.5.1
3448984
If you use NVUE to apply a configuration when the optional TACACS+ packages are not installed on the switch, you might see messages similar to the following in the /var/log/syslog file when auditd restarts (for example, when the switch reboots):
audispd: Unable to stat /sbin/audisp-tacplus (No such file or directory)
audispd: Skipping audisp-tacplus.conf plugin due to errors
These messages do not affect the functionality of the switch.
5.5.0-5.5.1
3447762
If the NVUE startup.yaml configuration file is invalid, the nv config apply startup command times out without providing details on the error.5.4.0-5.5.1
3444668
If the SDK becomes stuck and not able to process API calls, the systemd watchdog stops switchd and Cumulus Linux generates a cl-support file. switchd restarts after the watchdog timeout and then runs without issues
3436595
When using WJH, if you export dropped packets to a file in PCAP format, the file contains custom WJH header data. As a result, certain tools, such as Wireshark, cannot decode the data. To work around this issue, use the –no_metadata option with the export command:
cumulus@switch:~$ what-just-happened poll –export –no_metadata
5.4.0-5.5.1
3436305
Auto-negotiation and link-training is not supported at 25G between the NVIDIA SN5600 switch and non-NVIDIA devices.
3436296
On the NVIDIA SN5600 switch, the 8x port breakout is not supported with the MCP4Y10-N00A cable
3436291
The NVIDIA SN5600 switch does not support connecting to a Spectrum-2 or Spectrum-3 switch with an MCP7Y70-H001 4X breakout cable.
3436287
The NVIDIA SN5600 switch does not support connecting to a Spectrum-1 switch using a 2x breakout with the MCP7Y60-H001 copper cable at 25G.
3436229
On the NVIDIA SN5600 switch, when you connect a Service port to non-NVIDIA devices, auto-negotiation is not supported for 25G links.
3436215
On the NVIDIA SN5600 switch, the thermal control service crashes when you remove a fan tray.
3433944
The wjh_dissector.lua WJH packet decoder script provided with Cumulus Linux might fail to decode all WJH packets.5.4.0-5.5.1
3419940
When generating a cl-support file either manually or when an issue occurs on the system, you see the following kernel error messages:
‘Register access failed (reg_id=0x9029, status=0x4)’ followed by a hex dump of a few lines
This error message is benign and has no functional impact.
5.5.0-5.5.1
3413785
To reach the TACACS+ server through the default VRF, you must specify the egress interface you use in the default VRF. Either run the NVUE nv set system aaa tacacs vrf command (for example, nv set system aaa tacacs vrf swp51) or set the vrf= option in the /etc/tacplus_servers file (for example, vrf=swp51). A similar issue might prevent TACACS+ users with privilege level 15 from using sudo if the TACACS+ server is reachable only on the default VRF. If this occurs, and you do not run the above configuration workaround, the TACACS+ user with privilege level 15 can use vrf task exec default sudo … to execute the sudo command using the TACACS+ server on the default VRF.5.0.0-5.5.1
3394674
If you restart FRR with the log file debugging level set to informational, BGP crashes.5.4.0-5.5.1
3378733
After you add or delete a static MAC entry on the bridge FDB, a core dump occurs if the interface is VXLAN and the MAC address is 00:00:00:00:00:00.5.4.0-5.5.1
3344846
The Spectrum-3 hardware configuration is not optimized for the best PTP accuracy when using 25GbE. You might see higher than expected PTP offsets on this platforms and interface speed.5.4.0-5.5.1
3336808
If you run the NVUE nv set interface description command without providing a description, the nv config apply command fails with the error Unable to restart services (ifreload-nvue.service).5.4.0-5.5.1
3293114
In Cumulus Linux 5.4 and earlier, the command to enable Neighbor Discovery (ND) router advertisement is inverted and causes confusion; nv set interface ip neighbor-discovery router-advertisement enable off. In Cumulus Linux 5.5 and later, the command to enable router advertisement is updated to nv set interface ip neighbor-discovery router-advertisement enable on.5.3.0-5.5.1
3187469
At high scale with 160 VRFs and 10 VLANs per VRF (a total of 1600 VLANs), you see traffic loss during primary switch reboot. To work around this issue, reduce the scale to 40 VRFs with no more than 400 VLANs in the configuration, and use a common MAC address.5.1.0-5.5.1
3178090
The cl-support generation script causes TC filter collection to run as a background process for each interface, which can lead to memory exhaustion on a high scale configuration and on a switch with a small memory footprint.5.1.0-5.5.1
3172682
On rare occasions, when you query the system hostname through the hostnamctl application, you see a timeout. NVUE uses the hostnamctl application to determine the system hostname, which can result in an nv config apply command failure.5.2.0-5.5.1
3069069
When you run the systemctl reload switchd command, there is momentary traffic loss after a port configured with lossless buffers goes down. This is only temporary and the traffic stabilizes after the initial drops.5.1.0-5.5.1