Cumulus Linux 5.9 Release Notes
Download all 5.9 release notes as .xls5.9.2 Release Notes
Open Issues in 5.9.2
| Issue ID | Description | Affects | Fixed |
|---|---|---|---|
| 4100164 | Low power Intel SATA controllers experience issues when using the mobile low power chipset LPM policy. This can cause the SSD to become read only. | 5.8.0-5.10.1 | |
| 4081784 | If you configure an inbound route policy that drops prefixes, then run a vtysh show bgp vrf command, the BGP service might crash.>br>Avoid running a vtysh received routes show command if you configure an inbound route policy that drops prefixes. | 5.9.1-5.10.1 | |
| 4072165 | When you add a VLAN to a bridge member port, VXLAN traffic might be impacted for few seconds. | 5.7.0-5.10.1 | |
| 4066219 | Some STP interfaces might remain in a blocking state when there are large numbers of dis-contiguous VLANs enabled on a port. | 5.8.0-5.10.1 | |
| 4063273 | Low power Intel SATA controllers experience issues when using the mobile low power chipset LPM policy. This can cause the SSD to become read only. | 5.8.0-5.10.1 | |
| 4042657 | The SDK times out with a FW FATAL health event, which requires a reboot of the system to recover. | 5.9.1-5.10.0 | 5.10.1 |
| 4040024 | After network churn, the watchfrr process might restart FRR because zebra is unresponsive. | 5.9.1-5.10.0 | 5.10.1 |
| 4034329 | After network churn, the watchfrr process might restart FRR because zebra is unresponsive. | 5.9.1-5.10.0 | 5.10.1 |
| 3990135 | If there are multiple relay switches in the path reaching the DHCP server, DHCP packets are duplicated at each transit relay switch and the server receives duplicate packets. | 5.9.1-5.10.1 | |
| 3985600 | NTP initialization issues prevent the NTP service from starting on a non-default VRF. | 5.9.0-5.9.2 | 5.10.0-5.10.1 |
| 3890993 | On the NVIDIA spectrum-4 switch, l1-show command output does not show Eye opening information for an interface port. | 5.9.0-5.9.2 | 5.10.0-5.10.1 |
| 3878394 | When ZTP runs a script that contains wget, ZTP fails and you see a message similar to the following:ZTP: ZTP DHCP: Unexpected error: ‘ascii’ codec can’t decode byte 0xe2 in position 181: ordinal not in range(128)ZTP: Script returned failure To work around this issue, use the -q option with wget. | 5.9.0-5.10.1 | |
| 3873219 | When you remove a port from a bond and add it to the bridge in a single set of NVUE commands, then apply the configuration, the port forwarding state is blocked on all the bridge VLANs. To work around this issue, apply the configuration in two steps. First remove the port from the bond and apply the configuration, then add the port to the bridge and apply the configuration. | 5.9.0-5.9.2 | 5.10.0-5.10.1 |
| 3861745 | On UEFI hardware (where the /sys/firmware/efi directory exists), using the update-grub program might generate a /boot/grub/grub.cfg that is incorrect for booting ONIE if the ONIE option is selected on the console while booting. To work around this issue, run mount LABEL=“EFI System” /boot/efi before using update-grub. | 5.9.0-5.10.1 | |
| 3844670 | When you configure TACACS with NVUE or merge in an NVUE configuration file including TACACS configuration with the nv config patch command, you see an unrecoverable error when running additional NVUE commands. To work around this issue, restart the NVUE service with the systemctl restart nvued.service command. | 5.9.0-5.10.1 | |
| 3835635 | When adaptive routing is enabled, traffic for non adaptive routing enabled ports and non adaptive routing ECMPS might be routed over all ports in ECMP. Avoid using regular ECMPs with adaptive routing enabled on the switch. | 5.9.0-5.10.1 | |
| 3775686 | The BGP Suppress Route Advertisement feature under scale (more than 30000 routes) advertises partial updates to downstream neighbors. Because FRR does not read kernel route updates fast enough, the netlink socket receive buffer gets full and further update notifications are dropped. | 5.8.0-5.9.2 | 5.10.0-5.10.1 |
| 3773177 | When you try to upgrade a switch from Cumulus Linux 5.5 or earlier to 5.8.0 or later with package upgrade, you see errors for expired GPG keys that prevent you from upgrading. To work around this issue, install the new keys with the following commands, then upgrade the switch.cumulus@switch:~$ wget https://download.nvidia.com/cumulus/apt.cumulusnetworks.com/repo/pool/cumulus/c/cumulus-archive-keyring/cumulus-archive-keyring_4-cl5.6.0u5_all.deb | 4.0.0-4.4.5, 5.0.0-5.10.1 | |
| 3771168 | When you perform an ISSU upgrade on a Spectrum 1 switch, the switchd service might crash. | 5.8.0-5.10.1 | |
| 3739159 | Disabling adaptive routing globally or on interfaces and performing ISSU, has a significant traffic outage. The issue recovers after ISSU completes. | 5.7.0-5.10.1 | |
| 3711913 | When you set an IPv4 ACL with a log action, logs do not appear under syslog after a match. This issue affects bridged packets when the rule is installed in iptables. To work around this issue, set the ACL with a MAC rule type so that it is installed in ebtables and the packets are logged correctly in syslog.The following shows an example configuration: cumulus@switch:~$ nv set acl one rule 1 action log log-prefix NVIDIA | 5.7.0-5.9.2 | 5.10.0-5.10.1 |
| 3685007 | Cumulus Linux does not support 802.1X dynamic VLANs on PEAP with MS Windows-based supplicants. | 5.7.0-5.10.1 | |
| 3677533 | Due to resource constraints on the Spectrum 1 switch, staticd performance drops and takes longer to read static routes compared to the time BGP takes to complete a graceful restart, and advertise routes and EOR to its helpers. As a result, static routes are advertised after the EOR is sent to graceful restart helpers, which delete the stale static routes and relearn them after receiving the EOR from the restarting node. Temporary traffic loss might occur. | 5.7.0-5.10.1 | |
| 3637444 | Applying an inbound control plane ACL on the eth0 management interface does not take effect. To work around this issue, apply the ACL on the mgmt interface; for example, nv set interface mgmt acl . | 5.7.0-5.10.1 | |
| 3636266 | When an unresolved next hop is present in a next hop group, especially over an SVI interface, the switch checks if the neighbor MAC address is in the forwarding table. If the neighbor’s MAC address is not there, the switch skips this next hop from backend programming and you see the switchd error ERR NH: l3 nhg v6 l3 nhg contains one or more unresolvable nexthops. There is no impact to switch functionality as unresolved neighbors are not programmed in hardware until they are resolved. | 5.7.0-5.9.2 | 5.10.0-5.10.1 |
| 3610591 | After configuring the system level pre-login and post-login banner messages, the messages do not return to their default settings when you run the nv unset system command or the nv config apply empty command. | 5.7.0-5.9.2 | 5.10.0-5.10.1 |
| 3587393 | If you use the NVIDIA SN5600 (Spectrum-4) switch with Ixia test equipment, you might experience delayed link up due to intermittent link flaps. To work around this issue when using copper cables:
To work around this issue when using fiber cables:
| 5.6.0-5.10.1 | |
| 3556762 | On rare occasions, SPT switchover might not happen cleanly in PIM resulting in some dropped packets. If you use PIM-SM to replicate EVPN BUM traffic, you might see a brief drop of multicast traffic before recovering due to normal PIM-SM traffic timeout. | 5.5.0-5.10.1 | |
| 3538321 | In rare cases, an STP topology change on PTP over a VLAN can result in the switch losing the slave state and one of the ports might remain in an uncalibrated state. To work around this issue, toggle the port that is in the uncalibrated state up and down so that one of the ports is selected as the slave. | 5.6.0-5.10.1 | |
| 3452681 | When you run the NVUE nv show system aaa tacacs authorization commands to show per command authorization for a specific TACACS+ user privilege level, you see an error message similar to Error: GET /nvue_v1/system/aaa/tacacs/authorization/1?rev=operational responded with 404 NOT FOUND. | 5.5.0-5.10.1 | |
| 3442569 | When trying to access the NVUE API, user accounts authenticated with a newly-configured external service, such as TACACS, RADIUS, or LDAP, receive a 401 forbidden error. To work around this issue, after enabling a new authentication service, make sure to restart both nginx.service and nvued.service to begin authenticating users against the new authentication service. | 5.5.0-5.10.1 | |
| 3424967 | sudo for TACACS+ users with privilege level 15 does not work when reaching the TACACS+ server through the default VRF. To work around this issue, specify the interface name that the default VRF uses in the vrf= setting of the /etc/tacplus_servers file or run the NVUE nv set system aaa tacacs vrf command. If you don’t run either command, a TACACS+ user with privilege level 15 can run vrf task exec default sudo … to execute the sudo command. | 5.0.0-5.10.1 | |
| 3420056 | The ADVA 5401 SFP module with hardware revision 5.01 does not come up at layer 1 when you use 10G QSA adaptors. To work around this issue, use 25G QSA adaptors. | 4.4.0-4.4.5, 5.0.0-5.10.1 | |
| 3393966 | When you configure OSPF network statements using NVUE with the nv set vrf command, subsequent configuration changes with NVUE might bring down all OSPF neighbors. To work around this issue, create an NVUE snippet to configure the network statement, or use the nv set interface command to enable OSPF on interfaces instead of using a network statement. | 5.5.0-5.9.2 | 5.10.0-5.10.1 |
| 3362113 | If you restore an NVUE startup.yaml file or run the nv config patch command after an upgrade that includes breakout ports with QoS configuration, the NVUE configuration fails to apply. Subsequent attempts to run nv config apply fail with a message similar to Invalid config [rev_id: 11] qos config is not supported on the following invalid interface: swp1s0. Supported on swp and bond interface types. To work around this issue, run nv unset on the configured QoS settings, then apply the breakout port configuration before you configure QoS. Alternatively, you can remove the QoS configuration from the yaml file and patch it separately after applying the breakout configuration. | 5.4.0-5.10.1 | |
| 3347538 | When connecting NVIDIA-to-NVIDIA in PAM4, you must enable auto-negotiation. | 5.4.0-5.10.1 | |
| 3341214 | If you use the NVUE REST API to configure a local user with a hashed password, the user cannot log in and the /etc/nvue.d/startup.yaml file shows the password as plain text. | 5.4.0-5.10.1 | |
| 3329518 | When using TACACS+, if the /etc/nsswitch.conf file specifies passwd: files tacplus (files is listed before tacplus), a user that is present in both the local /etc/passwd file and the TACACS+ server cannot log into the switch. NVIDIA recommends that when using TACACS+, you list tacplus before files in /etc/nsswitch.conf. When using NVUE, ensure that tacacs has priority over local. | 5.4.0-5.10.1 | |
| 3327477 | If you use su to change to a user specified through TACACS+, the user becomes the local tacacs0 thru tacacs15 user instead of the named user to run sudo commands. As a result, the named user password might not match the local tacacs0 thru tacacs15 user password. | 3.7.0-3.7.16, 4.0.0-4.4.5, 5.0.0-5.10.1 | |
| 3326659 | If you have a large number of MAC addresses, they do not age out at the MAC ageing timeout value configured on the switch. It might take up to 30 seconds more for the MAC addresses to age out and be deleted from the hardware. To work around this issue, wait for the ageing timeout value plus 30 seconds. | 5.4.0-5.10.1 | |
| 3241567 | When you apply switch configuration for the first time on a freshly booted switch and you run the nv config apply command after setting the hostname with nv set system hostname, you might see the error message Failed to start Hostname Service. To work around this issue, run the nv config apply command a second time. | 5.3.0-5.10.1 | |
| 3226506 | The l1-show eth0 command does not show port information and is not supported in this release. | 5.3.0-5.10.1 | |
| 3172504 | When you connect the NVIDIA SN4600C switch to a Spectrum 1 or Spectrum-3 switch with a 40GbE passive copper cable (Part Number: MC2210126-005) on edge ports 1-4 and 61-64, there is an Effective BER of 1E-12 in PHY. | 5.2.0-5.10.1 | |
| 3147782 | You cannot use NVUE to configure an SNMP view to include a subtree beginning with a period. For example:cumulus@switch:~$ nv set service snmp-server viewname cumulusOnly included .1.3.6.1.4.1.40310Error: GET /nvue_v1/service/snmp-server/viewname/cumulusOnly/included?pointers=%5B%22%2Fparameters%22%2C+%22%2Fpatch%2FrequestBody%2Fcontent%2Fapplication~1json%2Fschema%22%2C+%22%2Fpatch%2Fparameters%22%2C+%22%2Fpatch%2Fresponses%2F200%2Flinks%22%5D responded with 404 NOT FOUNDTo work around this issue, reference the OID without the preceding period ( . ) in the command. | 5.3.0-5.10.1 | |
| 3145869 | On a Spectrum-3 switch, the PTP offset in 10GbE changes between +-27. The average offset is around 7. | 5.2.0-5.10.1 | |
| 3135952 | PAM4 split cables (such as 2x100G, 4x100G, and 4x50G) do not work with a forced speed setting (when auto-negotiation is off) as the default speed enabled is for NRZ mode (such as 100G_4X). To work around this issue, set the appropriate lanes for forced speed (with auto-negotation off) with the ethtool -s swpX speed <port_speed> autoneg off lanes <no_of_lanes> command. For example:cumulus@switch:~$ sudo ethtool -s swp1 speed 100000 autoneg off lanes 2 | 5.2.0-5.10.1 | |
| 3122301 | On the NVIDIA SN4700 switch, inserting and removing the PSU might cause loss of frames. | 5.2.0-5.10.1 | |
| 3115242 | When you configure two VNIs in the same VLAN, ifupdown2 shows a vlan added to two or more VXLANS warning, which is only issued after the VNI is already added to the bridge. This leaves the new VNI in the PVID even if there is already an existing VNI configured in that PVID. | 5.1.0-5.10.1 | |
| 3103821 | On the NVIDIA SN4700 switch, inserting and removing the PSU might cause loss of frames. | 5.2.0-5.10.1 | |
| 3084476 | After you disable traffic shaping in the /etc/cumulus/datapath/qos/qos_features.conf file, the default QOS traffic shaping configuration does not restore. To work around this issue, restart switchd. | 4.4.3, 5.0.0-5.10.1 | 4.4.4-4.4.5 |
| 3084027 | Under a high load, you might see ingress drop counters increase. The drops are classified as HwIfInDiscards in ethtool and shown as ingress_general in hardware. | 4.3.0-4.4.5, 5.0.0-5.10.1 | |
| 3071652 | On rare occasions, after you reboot or restart switchd on a Spectrum 1 switch, any 25G connections with Direct Attach Copper (DAC) cables that connect from the switch to a non-NVIDIA device might flap continuously. To work around this issue, bring the affected link administratively down for a few seconds on the non-NVIDIA device, then bring the link back up. | 4.4.4-4.4.5, 5.1.0-5.10.1 | |
| 3061656 | When the CPU load is high during a warm boot, bonds with a slow LACP rate fail to forward layer 2 traffic for up to 60 seconds (depending on the duration of the CPU load) and static bonds fail to forward layer 2 traffic for up to 5 seconds. | 5.1.0-5.10.1 | |
| 3053094 | When the CPU load is high during a warm boot, bonds with a slow LACP rate fail to forward layer 2 traffic for up to 60 seconds (depending on the duration of the CPU load) and static bonds fail to forward layer 2 traffic for up to 5 seconds. | 5.1.0-5.10.1 | |
| 2972540 | With RADIUS enabled for user shell authentication, there might be a delay in local user authentication for non cumulus user accounts. | 5.0.0-5.10.1 | |
| 2964279 | When a VNI flaps, an incorrect list of layer 2 VNIs are associated with a layer 3 VNI. The NCLU net show evpn vni detail command output shows duplicate layer 2 VNIs under a layer 3 VNI. | 3.7.15, 4.4.2-4.4.5, 5.0.0-5.10.1 | 3.7.16 |
| 2951110 | The net show time ntp servers command does not show any output with the management VRF. | 3.7.15-3.7.16, 4.1.1-4.4.5, 5.0.0-5.10.1 | |
| 2904450 | When you run the ethtool -m or the l1-show command, the 400G interface optical values do not show. | 4.4.0-4.4.5, 5.0.0-5.10.1 | |
| 2891255 | CVE-2021-39925: Buffer overflow in the Bluetooth SDP dissector in Wireshark 3.4.0 to 3.4.9 and 3.2.0 to 3.2.17 allows denial of service via packet injection or crafted capture file. Vulnerable: <= 2.6.20-0+deb10u1 Fixed: 2.6.20-0+deb10u2 | 4.0.0-4.4.1, 5.0.0-5.10.1 | 4.4.2-4.4.5 |
| 2890681 | CVE-2021-42771: relative path traversal in Babel, a set of tools for internationalising Python applications, could result in the execution of arbitrary code Vulnerable: 2.6.0+dfsg.1-1Fixed: 2.6.0+dfsg.1-1+deb10u1 | 4.0.0-4.4.1, 5.0.0-5.10.1 | 4.4.2-4.4.5 |
| 2867042 | When connecting the NVIDIA SN4600 switch to another NVIDIA Spectrum switch, you must use auto-negotiation mode (not force mode); otherwise the switch might use the wrong Tx configuration. | 5.0.0-5.10.1 | |
| 2847755 | When you use NCLU to remove the configuration for a peer that is a member of a group but also has other peer-specific configuration, you must remove the peer-specific configuration before you delete the peer in a separate NCLU commit. | 5.0.0-5.10.1 | |
| 2823307 | Cumuls Linux does not support a bond with more than 64 ports. Any configuration with more than 64 ports in a bond changes all ports to down when you apply the configuration. | 5.0.0-5.10.1 | |
| 2736108 | When you change the VRRP advertisement interval on the master, the master advertisement interval field in the show vrrp command output does not show the updated value. | 4.4.0-4.4.5, 5.0.0-5.10.1 | |
| 2684925 | The NVUE nv show vrf default router bgp peer command produces a 404 not found error. | 4.4.0-4.4.5, 5.0.0-5.10.1 | |
| 2671652 | In VXLAN routing environments, you might experience sub-optimal route convergence delays (longer than five seconds) when a prefix transitions to a new ECMP next-hop group. This condition might occur when a VTEP loses ECMP routes through all uplink peerings, then installs the routes through a different path, such as an MLAG peerlink. | 4.4.0-4.4.5, 5.5.0-5.10.1 | |
| 2543915 | When you enable a service in the management VRF, systemctl issues a warning similar to the following:Warning: The unit file, source configuration file or drop-ins of ntp@mgmt.service changed on disk. Run ‘systemctl daemon-reload’ to reload unitYou can safely ignore this warning. | 4.0.0-5.9.2 | 5.10.0-5.10.1 |
Fixed Issues in 5.9.2
| Issue ID | Description | Affects |
|---|---|---|
| 4043575 | If a ZTP script includes a directive to reboot, the reboot might stop the running ZTP process before it is able to disable itself from running again. As a result, the ZTP process starts again when the system comes back up. To work around this issue, run shutdown -r +1 to schedule a reboot after one minute so that the ZTP process can successfully complete disabling the ztp.service systemd service. | 5.10.0-5.10.1 |
| 4037160 | The SNMP service starts by default even when you do not enable SNMP. | |
| 4035681 | The nv show interface commands show RX and TX Power values from the wrong lanes on breakout ports. | 5.8.0-5.9.1, 5.10.0-5.10.1 |
| 4023637 | When you disable dynamic NAT manually in the /etc/cumulus/switchd.conf file instead of using NVUE commands but the dynamic NAT rules still exist in the /etc/cumulus/acl/policy,d/.rules file, the switch encounters a memory leak. To work around this issue, remove dynamic NAT rules in rules files in /etc/cumulus/acl/policy.d before you disable dynamic NAT in the /etc/cumulus/switchd.conf file. | 5.9.1 |
| 4012011 | A memory corruption kernel crash might occur due to a netfilter error. The log message from netfilter might contain a warning similar to the following:kernel: WARNING: CPU: 1 PID: 0 at net/netfilter/nf_conntrack_core.c:1210 __nf_conntrack_confirm+0x5c7/0x6b0 [nf_conntrack]kernel: RIP: 0010:__nf_conntrack_confirm+0x5c7/0x6b0 [nf_conntrack] | 5.9.1 |
| 4007612 | If you have SVIs with the same VLANs across more than one bridge, Cumulus Linux installs the router MAC for the first bridge only in the SDK. This can cause reachability issues within that VRF towards this switch from remote VTEPs. To work around this issue, bounce the second bridge with the sudo ifdown and sudo ifup commands. If you reboot the switch, you need to bounce the second bridge again. | 5.9.1 |
| 4004453 | The NVUE commands to delete SNMP users, and change authentication passwords and encryption passphrases are not successful. | 4.3.0-5.9.1, 5.10.0-5.10.1 |
| 3990258 | Cumulus Linux incorrectly handles unnumbered neighbor types, which causes discrepancies in the running configuration and session flaps during FRR reload. | 5.9.0-5.9.1, 5.10.0-5.10.1 |
| 3982222 | When SPAN is enabled on a bridge member, an ARP or Gratuitous ARP received during a failover event between locally attached redundant devices such as load balancers might fail to update the bridge MAC table to point to the interface with the newly active load balancer. | 5.4.0-5.9.1 |
| 3974890 | The ntpsec@mgmt service does not come up by default when you install an image with ONIE because the trigger to bring up the service is missing. | 5.9.1, 5.10.0-5.10.1 |
| 3970626 | When you configure the bridge.kernel_mac_refresh_interval parameter in the switchd.conf file, a switchd restart fails with a core dump. | 5.8.0-5.9.1 |
| 3966673 | In an EVPN multihoming deployment, if you enable multihoming without any local ESI configuration, arp-nd-redirect remains disabled unless you restart FRR. | 5.9.1 |
| 3965548 | The fans on the NVIDIA SN2410 switch (Part Number SSG7A80800) might spin at high speed. | 5.9.1 |
| 3965021 | The optical DOM information in ethtool -m command output is incorrect for SFP modules. | 5.9.1 |
| 3957691 | After a networking restart, ERSPAN mirror sessions might not start. To work around this issue, run the systemctl reload switchd command to start the ERSPAN mirror sessions. | 5.9.0-5.9.1, 5.10.0-5.10.1 |
| 3957620 | On a Spectrum-4 switch, if you use PTP on a 800G link, jumbo frames traversing the same link might cause a degradation in PTP performance. | 5.9.0-5.9.1, 5.10.0-5.10.1 |
| 3956091 | When you modify the default QoS configuration on top of the base RoCE configuration, NVUE reports an Invalid exception in the nv show qos roce command output even when the configuration is valid. | 5.8.0-5.9.1 |
| 3955615 | Cumulus Linux does not recognize QSFP_CMIS optical modules correctly. | 5.6.0-5.9.1 |
| 3954026 | Static ARP configured with NVUE commands is deleted when the relevant layer 3 interface flaps. | 5.8.0-5.9.1 |
| 3951643 | The NVUE unset and set command for the same object in a patch file (nv config patch ) causes a python exception. | 5.9.1 |
| 3950322 | After switchd restarts, the sFlow sampling rate set in the hardware might not match with the configured values for about 3 minutes. This issue occurs because interfaces are not yet up during the initial sampling rate setting. | 5.9.1 |
| 3949367 | If you use NVUE to create an SNMP user with a password, then delete and recreate the user with additional encryption passwords (such as DES or AES), SNMP authorization fails for that user. | 5.3.1-5.9.1 |
| 3947432 | In an EVPN multihoming configuration, if a host bond enters the protodown state due to a link flap, when you try to clear the protodown state, FRR reprograms it. | 5.9.1 |
| 3943834 | The default memory configuration for NVIDIA Cumulus VX OVA is too low and needs to be increased. | 5.9.0-5.9.1 |
| 3941608 | The default NIC for the VMWare OVA file is set to vmxnet3 instead of e1000. | 5.9.0-5.9.1 |
| 3939667 | On NVIDIA Cumulus VX, the password does not reset to the default value of cumulus. | 5.9.0-5.9.1 |
| 3935658 | SNMP IF-MIB reports all interfaces (including layer 3 and VNIs) as ifType=6 (ethernetCsmacd) instead of IANA MIB-II types. | 5.9.1 |
| 3929440 | When you enable or disable MLAG configuration on an interface, Cumulus Linux logs LACP partner MAC address and BPDU guard mismatches incorrectly. This issue does not impact functionality. | 5.9.0-5.9.1 |
| 3927016 | Following an EVPN extended mobility event, where a host with IPA and MACA moves within the fabric and now resides at IPA MACB, you might see traffic destined to this host experience drops as the flow is being software forwarded on the egress VTEP. | 5.9.1 |
| 3926523 | When there are multiple interface flaps with sFlow on 100G interfaces, sFlow might use a different value than the one configured. | 5.9.1 |
| 3925259 | When you start Cumulus VX in Vagrant with libvirt, VM provisioning might fail with errors that indicate a missing ifup@eth0.service systemd service. | 5.9.0-5.9.1 |
| 3917601 | If a packet containing an all zero source MAC address (00:00:00:00:00:00) is learned on the ASIC, switchd sends the learn notification to the kernel but the kernel rejects the MAC address as invalid. The ASIC continuously sends the mac-learn notifications, which wastes CPU resources. To work around this issue, configure ACLs to match on the all-zero source MAC address and drop the invalid packets. | 5.5.0-5.9.1 |
| 3917528 | With LACP bypass enabled, Cumulus Linux does not program the MAC address in the bridge FDB for VLAN unaware tagged ports. With EVPN, the address is not advertised and the remote side might flood the packet instead of unicast. | 5.8.0-5.9.1 |
| 3915842 | A kernel crash due to memory corruption might occur due to a netfilter error. The log message from netfilter might contain a warning similar to the following:kernel: WARNING: CPU: 1 PID: 0 at net/netfilter/nf_conntrack_core.c:1210 __nf_conntrack_confirm+0x5c7/0x6b0 [nf_conntrack]kernel: RIP: 0010:__nf_conntrack_confirm+0x5c7/0x6b0 [nf_conntrack] | 5.9.0-5.9.1 |
| 3904516 | With Optimized Multicast Flooding (OMF), when you unset multiple multicast router ports in a single commit, multicast traffic still floods one of the ports. To work around this issue, unset multicast router ports one by one instead of in a single commit. | 5.9.0-5.9.1 |
| 3896967 | PTP does not come up with IPv6 over a trunk port because the IPv6 VLAN tag is not sent. PTP over an IPv4 trunk works fine. | 5.8.0-5.9.1 |
| 3895042 | After an NMS station does a full SNMP walk on the switch, you see the following message every 5 minutes:snmp : command not allowed ; TTY=unknown ; PWD=/ ; USER=root ; COMMAND=/usr/cumulus/bin/poectl -j -a This issue occurs because poectl is called on non-PoE switches. To work around this issue, remove or comment out the poetcl call from the /etc/snmpd.conf file, then restart the snmpd process with the sudo systemctl snmpd restart command#snmp ALL = NOPASSWD: /usr/cumulus/bin/poectl -j -a | 4.4.0-5.9.1 |
| 3895017 | When ARP suppression is off, remote EVPN VTEPs duplicate ARP packets from local hosts and each remote host receives two copies of the ARP packets. The issue also applies to IPv6 ND packets. | 5.8.0-5.9.1 |
| 3881789 | If you configure the anycast IP address with the nv set nve vxlan mlag shared-address command after you configure MLAG, the anycast IP address configuration is not applied and the VXLAN interface is in a protodown state. To work around this issue, run sudo ifreload -a.To avoid this issue, either apply the anycast configuration before you apply the MLAG configuration or configure the anycast IP address and MLAG together with a single nv config apply command. | 5.9.0-5.9.1 |
| 3879635 | ERSPAN port-mirror sessions might not come up after a switchd service restart. To work around this issue and bring up the ERSPAN session, either run switchd reload after a switchd restart or use an ACL-based ERSPAN session. | 5.9.0-5.9.1 |
| 3878166 | The NVUE nv show interface eth0 and nv show vrf commands take more than two minutes to run if you have configured hundreds of interfaces because NVUE makes repetitive system calls to get vlan/link/tunnel bridge information. | 5.9.0-5.9.1 |
| 3875589 | MLAG bonds might report an incorrect DOWN reason of lacp partner mac mismatch when the bond is out of service for another reason. | 5.9.0-5.9.1 |
| 3859422 | On rare occasions when certain events occur, such as changes to the topology in the network, when a bond comes online and directly transits to an STP blocking state, the slave ports might still be in a forwarding state. As a result, traffic is forwarded on a blocked port. | 5.2.0-5.9.1 |
| 3854807 | When you enable Optimized Multicast Flooding (OMF) and change VLAN configuration, a few ports might carry multicast traffic even when they are not in the MDB or they are not router ports. | 5.6.0-5.9.1 |
| 3854800 | The switch forwards multicast traffic to the CPU when PIM is enabled globally, regardless of the interface configuration. | 5.6.0-5.9.1 |
| 3851499 | On the Spectrum A1 switch, when you enable the ip-acl-heavy TCAM profile, VXLAN tunnel initialization might fail. | 5.8.0-5.9.1 |
| 3821643 | When using SSM and the upstream interface goes away (the source stops sending or the link goes down) the PIMREG interface is added to the outgoing interface list of the S,G and is never removed. As a result, multicast traffic that hits the impacted S,G is forwarded to the CPU and dropped by the switch. | 5.9.0-5.9.1 |
| 3763543 | The NVIDIA SN4600C switch fails to boot fully after you upgrade from Cumulus Linux 4.2.1 to 5.7 with ONIE install. To work around this issue, perform an intermediate step image upgrade; for example, upgrade the switch from Cumulus Linux 4.2.1 to 5.2.1 to 5.7.0. |
5.9.1 Release Notes
Open Issues in 5.9.1
| Issue ID | Description | Affects | Fixed |
|---|---|---|---|
| 4100164 | Low power Intel SATA controllers experience issues when using the mobile low power chipset LPM policy. This can cause the SSD to become read only. | 5.8.0-5.10.1 | |
| 4081784 | If you configure an inbound route policy that drops prefixes, then run a vtysh show bgp vrf command, the BGP service might crash.>br>Avoid running a vtysh received routes show command if you configure an inbound route policy that drops prefixes. | 5.9.1-5.10.1 | |
| 4072165 | When you add a VLAN to a bridge member port, VXLAN traffic might be impacted for few seconds. | 5.7.0-5.10.1 | |
| 4066219 | Some STP interfaces might remain in a blocking state when there are large numbers of dis-contiguous VLANs enabled on a port. | 5.8.0-5.10.1 | |
| 4063273 | Low power Intel SATA controllers experience issues when using the mobile low power chipset LPM policy. This can cause the SSD to become read only. | 5.8.0-5.10.1 | |
| 4042657 | The SDK times out with a FW FATAL health event, which requires a reboot of the system to recover. | 5.9.1-5.10.0 | 5.10.1 |
| 4040024 | After network churn, the watchfrr process might restart FRR because zebra is unresponsive. | 5.9.1-5.10.0 | 5.10.1 |
| 4035681 | The nv show interface commands show RX and TX Power values from the wrong lanes on breakout ports. | 5.8.0-5.9.1, 5.10.0-5.10.1 | 5.9.2 |
| 4034329 | After network churn, the watchfrr process might restart FRR because zebra is unresponsive. | 5.9.1-5.10.0 | 5.10.1 |
| 4023637 | When you disable dynamic NAT manually in the /etc/cumulus/switchd.conf file instead of using NVUE commands but the dynamic NAT rules still exist in the /etc/cumulus/acl/policy,d/.rules file, the switch encounters a memory leak. To work around this issue, remove dynamic NAT rules in rules files in /etc/cumulus/acl/policy.d before you disable dynamic NAT in the /etc/cumulus/switchd.conf file. | 5.9.1 | 5.9.2-5.10.1 |
| 4012011 | A memory corruption kernel crash might occur due to a netfilter error. The log message from netfilter might contain a warning similar to the following:kernel: WARNING: CPU: 1 PID: 0 at net/netfilter/nf_conntrack_core.c:1210 __nf_conntrack_confirm+0x5c7/0x6b0 [nf_conntrack]kernel: RIP: 0010:__nf_conntrack_confirm+0x5c7/0x6b0 [nf_conntrack] | 5.9.1 | 5.9.2-5.10.1 |
| 4007612 | If you have SVIs with the same VLANs across more than one bridge, Cumulus Linux installs the router MAC for the first bridge only in the SDK. This can cause reachability issues within that VRF towards this switch from remote VTEPs. To work around this issue, bounce the second bridge with the sudo ifdown and sudo ifup commands. If you reboot the switch, you need to bounce the second bridge again. | 5.9.1 | 5.9.2-5.10.1 |
| 4004453 | The NVUE commands to delete SNMP users, and change authentication passwords and encryption passphrases are not successful. | 4.3.0-5.9.1, 5.10.0-5.10.1 | 5.9.2 |
| 3990258 | Cumulus Linux incorrectly handles unnumbered neighbor types, which causes discrepancies in the running configuration and session flaps during FRR reload. | 5.9.0-5.9.1, 5.10.0-5.10.1 | 5.9.2 |
| 3990135 | If there are multiple relay switches in the path reaching the DHCP server, DHCP packets are duplicated at each transit relay switch and the server receives duplicate packets. | 5.9.1-5.10.1 | |
| 3985600 | NTP initialization issues prevent the NTP service from starting on a non-default VRF. | 5.9.0-5.9.2 | 5.10.0-5.10.1 |
| 3982222 | When SPAN is enabled on a bridge member, an ARP or Gratuitous ARP received during a failover event between locally attached redundant devices such as load balancers might fail to update the bridge MAC table to point to the interface with the newly active load balancer. | 5.4.0-5.9.1 | 5.9.2-5.10.1 |
| 3974890 | The ntpsec@mgmt service does not come up by default when you install an image with ONIE because the trigger to bring up the service is missing. | 5.9.1, 5.10.0-5.10.1 | 5.9.2 |
| 3970626 | When you configure the bridge.kernel_mac_refresh_interval parameter in the switchd.conf file, a switchd restart fails with a core dump. | 5.8.0-5.9.1 | 5.9.2-5.10.1 |
| 3966673 | In an EVPN multihoming deployment, if you enable multihoming without any local ESI configuration, arp-nd-redirect remains disabled unless you restart FRR. | 5.9.1 | 5.9.2-5.10.1 |
| 3965548 | The fans on the NVIDIA SN2410 switch (Part Number SSG7A80800) might spin at high speed. | 5.9.1-5.9.2 | 5.10.0-5.10.1 |
| 3965021 | The optical DOM information in ethtool -m command output is incorrect for SFP modules. | 5.9.1 | 5.9.2-5.10.1 |
| 3957691 | After a networking restart, ERSPAN mirror sessions might not start. To work around this issue, run the systemctl reload switchd command to start the ERSPAN mirror sessions. | 5.9.0-5.9.1, 5.10.0-5.10.1 | 5.9.2 |
| 3957620 | On a Spectrum-4 switch, if you use PTP on a 800G link, jumbo frames traversing the same link might cause a degradation in PTP performance. | 5.9.0-5.9.1, 5.10.0-5.10.1 | 5.9.2 |
| 3956091 | When you modify the default QoS configuration on top of the base RoCE configuration, NVUE reports an Invalid exception in the nv show qos roce command output even when the configuration is valid. | 5.8.0-5.9.1 | 5.9.2-5.10.1 |
| 3955615 | Cumulus Linux does not recognize QSFP_CMIS optical modules correctly. | 5.6.0-5.9.1 | 5.9.2-5.10.1 |
| 3954026 | Static ARP configured with NVUE commands is deleted when the relevant layer 3 interface flaps. | 5.8.0-5.9.1 | 5.9.2-5.10.1 |
| 3951643 | The NVUE unset and set command for the same object in a patch file (nv config patch ) causes a python exception. | 5.9.1 | 5.9.2-5.10.1 |
| 3950322 | After switchd restarts, the sFlow sampling rate set in the hardware might not match with the configured values for about 3 minutes. This issue occurs because interfaces are not yet up during the initial sampling rate setting. | 5.9.1 | 5.9.2-5.10.1 |
| 3949367 | If you use NVUE to create an SNMP user with a password, then delete and recreate the user with additional encryption passwords (such as DES or AES), SNMP authorization fails for that user. | 5.3.1-5.9.1 | 5.9.2-5.10.1 |
| 3947432 | In an EVPN multihoming configuration, if a host bond enters the protodown state due to a link flap, when you try to clear the protodown state, FRR reprograms it. | 5.9.1 | 5.9.2-5.10.1 |
| 3943834 | The default memory configuration for NVIDIA Cumulus VX OVA is too low and needs to be increased. | 5.9.0-5.9.1 | 5.9.2-5.10.1 |
| 3941608 | The default NIC for the VMWare OVA file is set to vmxnet3 instead of e1000. | 5.9.0-5.9.1 | 5.9.2-5.10.1 |
| 3939667 | On NVIDIA Cumulus VX, the password does not reset to the default value of cumulus. | 5.9.0-5.9.1 | 5.9.2-5.10.1 |
| 3935658 | SNMP IF-MIB reports all interfaces (including layer 3 and VNIs) as ifType=6 (ethernetCsmacd) instead of IANA MIB-II types. | 5.9.1 | 5.9.2-5.10.1 |
| 3929440 | When you enable or disable MLAG configuration on an interface, Cumulus Linux logs LACP partner MAC address and BPDU guard mismatches incorrectly. This issue does not impact functionality. | 5.9.0-5.9.1 | 5.9.2-5.10.1 |
| 3927016 | Following an EVPN extended mobility event, where a host with IPA and MACA moves within the fabric and now resides at IPA MACB, you might see traffic destined to this host experience drops as the flow is being software forwarded on the egress VTEP. | 5.9.1 | 5.9.2-5.10.1 |
| 3926523 | When there are multiple interface flaps with sFlow on 100G interfaces, sFlow might use a different value than the one configured. | 5.9.1 | 5.9.2-5.10.1 |
| 3925259 | When you start Cumulus VX in Vagrant with libvirt, VM provisioning might fail with errors that indicate a missing ifup@eth0.service systemd service. | 5.9.0-5.9.1 | 5.9.2-5.10.1 |
| 3917601 | If a packet containing an all zero source MAC address (00:00:00:00:00:00) is learned on the ASIC, switchd sends the learn notification to the kernel but the kernel rejects the MAC address as invalid. The ASIC continuously sends the mac-learn notifications, which wastes CPU resources. To work around this issue, configure ACLs to match on the all-zero source MAC address and drop the invalid packets. | 5.5.0-5.9.1 | 5.9.2-5.10.1 |
| 3917528 | With LACP bypass enabled, Cumulus Linux does not program the MAC address in the bridge FDB for VLAN unaware tagged ports. With EVPN, the address is not advertised and the remote side might flood the packet instead of unicast. | 5.8.0-5.9.1 | 5.9.2-5.10.1 |
| 3915842 | A kernel crash due to memory corruption might occur due to a netfilter error. The log message from netfilter might contain a warning similar to the following:kernel: WARNING: CPU: 1 PID: 0 at net/netfilter/nf_conntrack_core.c:1210 __nf_conntrack_confirm+0x5c7/0x6b0 [nf_conntrack]kernel: RIP: 0010:__nf_conntrack_confirm+0x5c7/0x6b0 [nf_conntrack] | 5.9.0-5.9.1 | 5.9.2-5.10.1 |
| 3904516 | With Optimized Multicast Flooding (OMF), when you unset multiple multicast router ports in a single commit, multicast traffic still floods one of the ports. To work around this issue, unset multicast router ports one by one instead of in a single commit. | 5.9.0-5.9.1 | 5.9.2-5.10.1 |
| 3896967 | PTP does not come up with IPv6 over a trunk port because the IPv6 VLAN tag is not sent. PTP over an IPv4 trunk works fine. | 5.8.0-5.9.1 | 5.9.2-5.10.1 |
| 3895042 | After an NMS station does a full SNMP walk on the switch, you see the following message every 5 minutes:snmp : command not allowed ; TTY=unknown ; PWD=/ ; USER=root ; COMMAND=/usr/cumulus/bin/poectl -j -a This issue occurs because poectl is called on non-PoE switches. To work around this issue, remove or comment out the poetcl call from the /etc/snmpd.conf file, then restart the snmpd process with the sudo systemctl snmpd restart command#snmp ALL = NOPASSWD: /usr/cumulus/bin/poectl -j -a | 4.4.0-5.9.1 | 5.9.2-5.10.1 |
| 3895017 | When ARP suppression is off, remote EVPN VTEPs duplicate ARP packets from local hosts and each remote host receives two copies of the ARP packets. The issue also applies to IPv6 ND packets. | 5.8.0-5.9.1 | 5.9.2-5.10.1 |
| 3890993 | On the NVIDIA spectrum-4 switch, l1-show command output does not show Eye opening information for an interface port. | 5.9.0-5.9.2 | 5.10.0-5.10.1 |
| 3881789 | If you configure the anycast IP address with the nv set nve vxlan mlag shared-address command after you configure MLAG, the anycast IP address configuration is not applied and the VXLAN interface is in a protodown state. To work around this issue, run sudo ifreload -a.To avoid this issue, either apply the anycast configuration before you apply the MLAG configuration or configure the anycast IP address and MLAG together with a single nv config apply command. | 5.9.0-5.9.1 | 5.9.2-5.10.1 |
| 3879635 | ERSPAN port-mirror sessions might not come up after a switchd service restart. To work around this issue and bring up the ERSPAN session, either run switchd reload after a switchd restart or use an ACL-based ERSPAN session. | 5.9.0-5.9.1 | 5.9.2-5.10.1 |
| 3878394 | When ZTP runs a script that contains wget, ZTP fails and you see a message similar to the following:ZTP: ZTP DHCP: Unexpected error: ‘ascii’ codec can’t decode byte 0xe2 in position 181: ordinal not in range(128)ZTP: Script returned failure To work around this issue, use the -q option with wget. | 5.9.0-5.10.1 | |
| 3878166 | The NVUE nv show interface eth0 and nv show vrf commands take more than two minutes to run if you have configured hundreds of interfaces because NVUE makes repetitive system calls to get vlan/link/tunnel bridge information. | 5.9.0-5.9.1 | 5.9.2-5.10.1 |
| 3875589 | MLAG bonds might report an incorrect DOWN reason of lacp partner mac mismatch when the bond is out of service for another reason. | 5.9.0-5.9.1 | 5.9.2-5.10.1 |
| 3873219 | When you remove a port from a bond and add it to the bridge in a single set of NVUE commands, then apply the configuration, the port forwarding state is blocked on all the bridge VLANs. To work around this issue, apply the configuration in two steps. First remove the port from the bond and apply the configuration, then add the port to the bridge and apply the configuration. | 5.9.0-5.9.2 | 5.10.0-5.10.1 |
| 3861745 | On UEFI hardware (where the /sys/firmware/efi directory exists), using the update-grub program might generate a /boot/grub/grub.cfg that is incorrect for booting ONIE if the ONIE option is selected on the console while booting. To work around this issue, run mount LABEL=“EFI System” /boot/efi before using update-grub. | 5.9.0-5.10.1 | |
| 3859422 | On rare occasions when certain events occur, such as changes to the topology in the network, when a bond comes online and directly transits to an STP blocking state, the slave ports might still be in a forwarding state. As a result, traffic is forwarded on a blocked port. | 5.2.0-5.9.1 | 5.9.2-5.10.1 |
| 3854807 | When you enable Optimized Multicast Flooding (OMF) and change VLAN configuration, a few ports might carry multicast traffic even when they are not in the MDB or they are not router ports. | 5.6.0-5.9.1 | 5.9.2-5.10.1 |
| 3854800 | The switch forwards multicast traffic to the CPU when PIM is enabled globally, regardless of the interface configuration. | 5.6.0-5.9.1 | 5.9.2-5.10.1 |
| 3851499 | On the Spectrum A1 switch, when you enable the ip-acl-heavy TCAM profile, VXLAN tunnel initialization might fail. | 5.8.0-5.9.1 | 5.9.2-5.10.1 |
| 3844670 | When you configure TACACS with NVUE or merge in an NVUE configuration file including TACACS configuration with the nv config patch command, you see an unrecoverable error when running additional NVUE commands. To work around this issue, restart the NVUE service with the systemctl restart nvued.service command. | 5.9.0-5.10.1 | |
| 3835635 | When adaptive routing is enabled, traffic for non adaptive routing enabled ports and non adaptive routing ECMPS might be routed over all ports in ECMP. Avoid using regular ECMPs with adaptive routing enabled on the switch. | 5.9.0-5.10.1 | |
| 3821643 | When using SSM and the upstream interface goes away (the source stops sending or the link goes down) the PIMREG interface is added to the outgoing interface list of the S,G and is never removed. As a result, multicast traffic that hits the impacted S,G is forwarded to the CPU and dropped by the switch. | 5.9.0-5.9.1 | 5.9.2-5.10.1 |
| 3775686 | The BGP Suppress Route Advertisement feature under scale (more than 30000 routes) advertises partial updates to downstream neighbors. Because FRR does not read kernel route updates fast enough, the netlink socket receive buffer gets full and further update notifications are dropped. | 5.8.0-5.9.2 | 5.10.0-5.10.1 |
| 3773177 | When you try to upgrade a switch from Cumulus Linux 5.5 or earlier to 5.8.0 or later with package upgrade, you see errors for expired GPG keys that prevent you from upgrading. To work around this issue, install the new keys with the following commands, then upgrade the switch.cumulus@switch:~$ wget https://download.nvidia.com/cumulus/apt.cumulusnetworks.com/repo/pool/cumulus/c/cumulus-archive-keyring/cumulus-archive-keyring_4-cl5.6.0u5_all.deb | 4.0.0-4.4.5, 5.0.0-5.10.1 | |
| 3771168 | When you perform an ISSU upgrade on a Spectrum 1 switch, the switchd service might crash. | 5.8.0-5.10.1 | |
| 3739159 | Disabling adaptive routing globally or on interfaces and performing ISSU, has a significant traffic outage. The issue recovers after ISSU completes. | 5.7.0-5.10.1 | |
| 3711913 | When you set an IPv4 ACL with a log action, logs do not appear under syslog after a match. This issue affects bridged packets when the rule is installed in iptables. To work around this issue, set the ACL with a MAC rule type so that it is installed in ebtables and the packets are logged correctly in syslog.The following shows an example configuration: cumulus@switch:~$ nv set acl one rule 1 action log log-prefix NVIDIA | 5.7.0-5.9.2 | 5.10.0-5.10.1 |
| 3685007 | Cumulus Linux does not support 802.1X dynamic VLANs on PEAP with MS Windows-based supplicants. | 5.7.0-5.10.1 | |
| 3677533 | Due to resource constraints on the Spectrum 1 switch, staticd performance drops and takes longer to read static routes compared to the time BGP takes to complete a graceful restart, and advertise routes and EOR to its helpers. As a result, static routes are advertised after the EOR is sent to graceful restart helpers, which delete the stale static routes and relearn them after receiving the EOR from the restarting node. Temporary traffic loss might occur. | 5.7.0-5.10.1 | |
| 3637444 | Applying an inbound control plane ACL on the eth0 management interface does not take effect. To work around this issue, apply the ACL on the mgmt interface; for example, nv set interface mgmt acl . | 5.7.0-5.10.1 | |
| 3636266 | When an unresolved next hop is present in a next hop group, especially over an SVI interface, the switch checks if the neighbor MAC address is in the forwarding table. If the neighbor’s MAC address is not there, the switch skips this next hop from backend programming and you see the switchd error ERR NH: l3 nhg v6 l3 nhg contains one or more unresolvable nexthops. There is no impact to switch functionality as unresolved neighbors are not programmed in hardware until they are resolved. | 5.7.0-5.9.2 | 5.10.0-5.10.1 |
| 3610591 | After configuring the system level pre-login and post-login banner messages, the messages do not return to their default settings when you run the nv unset system command or the nv config apply empty command. | 5.7.0-5.9.2 | 5.10.0-5.10.1 |
| 3587393 | If you use the NVIDIA SN5600 (Spectrum-4) switch with Ixia test equipment, you might experience delayed link up due to intermittent link flaps. To work around this issue when using copper cables:
To work around this issue when using fiber cables:
| 5.6.0-5.10.1 | |
| 3556762 | On rare occasions, SPT switchover might not happen cleanly in PIM resulting in some dropped packets. If you use PIM-SM to replicate EVPN BUM traffic, you might see a brief drop of multicast traffic before recovering due to normal PIM-SM traffic timeout. | 5.5.0-5.10.1 | |
| 3538321 | In rare cases, an STP topology change on PTP over a VLAN can result in the switch losing the slave state and one of the ports might remain in an uncalibrated state. To work around this issue, toggle the port that is in the uncalibrated state up and down so that one of the ports is selected as the slave. | 5.6.0-5.10.1 | |
| 3452681 | When you run the NVUE nv show system aaa tacacs authorization commands to show per command authorization for a specific TACACS+ user privilege level, you see an error message similar to Error: GET /nvue_v1/system/aaa/tacacs/authorization/1?rev=operational responded with 404 NOT FOUND. | 5.5.0-5.10.1 | |
| 3442569 | When trying to access the NVUE API, user accounts authenticated with a newly-configured external service, such as TACACS, RADIUS, or LDAP, receive a 401 forbidden error. To work around this issue, after enabling a new authentication service, make sure to restart both nginx.service and nvued.service to begin authenticating users against the new authentication service. | 5.5.0-5.10.1 | |
| 3424967 | sudo for TACACS+ users with privilege level 15 does not work when reaching the TACACS+ server through the default VRF. To work around this issue, specify the interface name that the default VRF uses in the vrf= setting of the /etc/tacplus_servers file or run the NVUE nv set system aaa tacacs vrf command. If you don’t run either command, a TACACS+ user with privilege level 15 can run vrf task exec default sudo … to execute the sudo command. | 5.0.0-5.10.1 | |
| 3420056 | The ADVA 5401 SFP module with hardware revision 5.01 does not come up at layer 1 when you use 10G QSA adaptors. To work around this issue, use 25G QSA adaptors. | 4.4.0-4.4.5, 5.0.0-5.10.1 | |
| 3393966 | When you configure OSPF network statements using NVUE with the nv set vrf command, subsequent configuration changes with NVUE might bring down all OSPF neighbors. To work around this issue, create an NVUE snippet to configure the network statement, or use the nv set interface command to enable OSPF on interfaces instead of using a network statement. | 5.5.0-5.9.2 | 5.10.0-5.10.1 |
| 3362113 | If you restore an NVUE startup.yaml file or run the nv config patch command after an upgrade that includes breakout ports with QoS configuration, the NVUE configuration fails to apply. Subsequent attempts to run nv config apply fail with a message similar to Invalid config [rev_id: 11] qos config is not supported on the following invalid interface: swp1s0. Supported on swp and bond interface types. To work around this issue, run nv unset on the configured QoS settings, then apply the breakout port configuration before you configure QoS. Alternatively, you can remove the QoS configuration from the yaml file and patch it separately after applying the breakout configuration. | 5.4.0-5.10.1 | |
| 3347538 | When connecting NVIDIA-to-NVIDIA in PAM4, you must enable auto-negotiation. | 5.4.0-5.10.1 | |
| 3341214 | If you use the NVUE REST API to configure a local user with a hashed password, the user cannot log in and the /etc/nvue.d/startup.yaml file shows the password as plain text. | 5.4.0-5.10.1 | |
| 3329518 | When using TACACS+, if the /etc/nsswitch.conf file specifies passwd: files tacplus (files is listed before tacplus), a user that is present in both the local /etc/passwd file and the TACACS+ server cannot log into the switch. NVIDIA recommends that when using TACACS+, you list tacplus before files in /etc/nsswitch.conf. When using NVUE, ensure that tacacs has priority over local. | 5.4.0-5.10.1 | |
| 3327477 | If you use su to change to a user specified through TACACS+, the user becomes the local tacacs0 thru tacacs15 user instead of the named user to run sudo commands. As a result, the named user password might not match the local tacacs0 thru tacacs15 user password. | 3.7.0-3.7.16, 4.0.0-4.4.5, 5.0.0-5.10.1 | |
| 3326659 | If you have a large number of MAC addresses, they do not age out at the MAC ageing timeout value configured on the switch. It might take up to 30 seconds more for the MAC addresses to age out and be deleted from the hardware. To work around this issue, wait for the ageing timeout value plus 30 seconds. | 5.4.0-5.10.1 | |
| 3241567 | When you apply switch configuration for the first time on a freshly booted switch and you run the nv config apply command after setting the hostname with nv set system hostname, you might see the error message Failed to start Hostname Service. To work around this issue, run the nv config apply command a second time. | 5.3.0-5.10.1 | |
| 3226506 | The l1-show eth0 command does not show port information and is not supported in this release. | 5.3.0-5.10.1 | |
| 3172504 | When you connect the NVIDIA SN4600C switch to a Spectrum 1 or Spectrum-3 switch with a 40GbE passive copper cable (Part Number: MC2210126-005) on edge ports 1-4 and 61-64, there is an Effective BER of 1E-12 in PHY. | 5.2.0-5.10.1 | |
| 3147782 | You cannot use NVUE to configure an SNMP view to include a subtree beginning with a period. For example:cumulus@switch:~$ nv set service snmp-server viewname cumulusOnly included .1.3.6.1.4.1.40310Error: GET /nvue_v1/service/snmp-server/viewname/cumulusOnly/included?pointers=%5B%22%2Fparameters%22%2C+%22%2Fpatch%2FrequestBody%2Fcontent%2Fapplication~1json%2Fschema%22%2C+%22%2Fpatch%2Fparameters%22%2C+%22%2Fpatch%2Fresponses%2F200%2Flinks%22%5D responded with 404 NOT FOUNDTo work around this issue, reference the OID without the preceding period ( . ) in the command. | 5.3.0-5.10.1 | |
| 3145869 | On a Spectrum-3 switch, the PTP offset in 10GbE changes between +-27. The average offset is around 7. | 5.2.0-5.10.1 | |
| 3135952 | PAM4 split cables (such as 2x100G, 4x100G, and 4x50G) do not work with a forced speed setting (when auto-negotiation is off) as the default speed enabled is for NRZ mode (such as 100G_4X). To work around this issue, set the appropriate lanes for forced speed (with auto-negotation off) with the ethtool -s swpX speed <port_speed> autoneg off lanes <no_of_lanes> command. For example:cumulus@switch:~$ sudo ethtool -s swp1 speed 100000 autoneg off lanes 2 | 5.2.0-5.10.1 | |
| 3122301 | On the NVIDIA SN4700 switch, inserting and removing the PSU might cause loss of frames. | 5.2.0-5.10.1 | |
| 3115242 | When you configure two VNIs in the same VLAN, ifupdown2 shows a vlan added to two or more VXLANS warning, which is only issued after the VNI is already added to the bridge. This leaves the new VNI in the PVID even if there is already an existing VNI configured in that PVID. | 5.1.0-5.10.1 | |
| 3103821 | On the NVIDIA SN4700 switch, inserting and removing the PSU might cause loss of frames. | 5.2.0-5.10.1 | |
| 3084476 | After you disable traffic shaping in the /etc/cumulus/datapath/qos/qos_features.conf file, the default QOS traffic shaping configuration does not restore. To work around this issue, restart switchd. | 4.4.3, 5.0.0-5.10.1 | 4.4.4-4.4.5 |
| 3084027 | Under a high load, you might see ingress drop counters increase. The drops are classified as HwIfInDiscards in ethtool and shown as ingress_general in hardware. | 4.3.0-4.4.5, 5.0.0-5.10.1 | |
| 3071652 | On rare occasions, after you reboot or restart switchd on a Spectrum 1 switch, any 25G connections with Direct Attach Copper (DAC) cables that connect from the switch to a non-NVIDIA device might flap continuously. To work around this issue, bring the affected link administratively down for a few seconds on the non-NVIDIA device, then bring the link back up. | 4.4.4-4.4.5, 5.1.0-5.10.1 | |
| 3061656 | When the CPU load is high during a warm boot, bonds with a slow LACP rate fail to forward layer 2 traffic for up to 60 seconds (depending on the duration of the CPU load) and static bonds fail to forward layer 2 traffic for up to 5 seconds. | 5.1.0-5.10.1 | |
| 3053094 | When the CPU load is high during a warm boot, bonds with a slow LACP rate fail to forward layer 2 traffic for up to 60 seconds (depending on the duration of the CPU load) and static bonds fail to forward layer 2 traffic for up to 5 seconds. | 5.1.0-5.10.1 | |
| 2972540 | With RADIUS enabled for user shell authentication, there might be a delay in local user authentication for non cumulus user accounts. | 5.0.0-5.10.1 | |
| 2964279 | When a VNI flaps, an incorrect list of layer 2 VNIs are associated with a layer 3 VNI. The NCLU net show evpn vni detail command output shows duplicate layer 2 VNIs under a layer 3 VNI. | 3.7.15, 4.4.2-4.4.5, 5.0.0-5.10.1 | 3.7.16 |
| 2951110 | The net show time ntp servers command does not show any output with the management VRF. | 3.7.15-3.7.16, 4.1.1-4.4.5, 5.0.0-5.10.1 | |
| 2904450 | When you run the ethtool -m or the l1-show command, the 400G interface optical values do not show. | 4.4.0-4.4.5, 5.0.0-5.10.1 | |
| 2891255 | CVE-2021-39925: Buffer overflow in the Bluetooth SDP dissector in Wireshark 3.4.0 to 3.4.9 and 3.2.0 to 3.2.17 allows denial of service via packet injection or crafted capture file. Vulnerable: <= 2.6.20-0+deb10u1 Fixed: 2.6.20-0+deb10u2 | 4.0.0-4.4.1, 5.0.0-5.10.1 | 4.4.2-4.4.5 |
| 2890681 | CVE-2021-42771: relative path traversal in Babel, a set of tools for internationalising Python applications, could result in the execution of arbitrary code Vulnerable: 2.6.0+dfsg.1-1Fixed: 2.6.0+dfsg.1-1+deb10u1 | 4.0.0-4.4.1, 5.0.0-5.10.1 | 4.4.2-4.4.5 |
| 2867042 | When connecting the NVIDIA SN4600 switch to another NVIDIA Spectrum switch, you must use auto-negotiation mode (not force mode); otherwise the switch might use the wrong Tx configuration. | 5.0.0-5.10.1 | |
| 2847755 | When you use NCLU to remove the configuration for a peer that is a member of a group but also has other peer-specific configuration, you must remove the peer-specific configuration before you delete the peer in a separate NCLU commit. | 5.0.0-5.10.1 | |
| 2823307 | Cumuls Linux does not support a bond with more than 64 ports. Any configuration with more than 64 ports in a bond changes all ports to down when you apply the configuration. | 5.0.0-5.10.1 | |
| 2736108 | When you change the VRRP advertisement interval on the master, the master advertisement interval field in the show vrrp command output does not show the updated value. | 4.4.0-4.4.5, 5.0.0-5.10.1 | |
| 2684925 | The NVUE nv show vrf default router bgp peer command produces a 404 not found error. | 4.4.0-4.4.5, 5.0.0-5.10.1 | |
| 2671652 | In VXLAN routing environments, you might experience sub-optimal route convergence delays (longer than five seconds) when a prefix transitions to a new ECMP next-hop group. This condition might occur when a VTEP loses ECMP routes through all uplink peerings, then installs the routes through a different path, such as an MLAG peerlink. | 4.4.0-4.4.5, 5.5.0-5.10.1 | |
| 2543915 | When you enable a service in the management VRF, systemctl issues a warning similar to the following:Warning: The unit file, source configuration file or drop-ins of ntp@mgmt.service changed on disk. Run ‘systemctl daemon-reload’ to reload unitYou can safely ignore this warning. | 4.0.0-5.9.2 | 5.10.0-5.10.1 |
Fixed Issues in 5.9.1
| Issue ID | Description | Affects |
|---|---|---|
| 3915829 | General improvements to overall software stability. | 5.9.0 |
5.9.0 Release Notes
Open Issues in 5.9.0
| Issue ID | Description | Affects | Fixed |
|---|---|---|---|
| 4100164 | Low power Intel SATA controllers experience issues when using the mobile low power chipset LPM policy. This can cause the SSD to become read only. | 5.8.0-5.10.1 | |
| 4072165 | When you add a VLAN to a bridge member port, VXLAN traffic might be impacted for few seconds. | 5.7.0-5.10.1 | |
| 4066219 | Some STP interfaces might remain in a blocking state when there are large numbers of dis-contiguous VLANs enabled on a port. | 5.8.0-5.10.1 | |
| 4063273 | Low power Intel SATA controllers experience issues when using the mobile low power chipset LPM policy. This can cause the SSD to become read only. | 5.8.0-5.10.1 | |
| 4035681 | The nv show interface commands show RX and TX Power values from the wrong lanes on breakout ports. | 5.8.0-5.9.1, 5.10.0-5.10.1 | 5.9.2 |
| 4004453 | The NVUE commands to delete SNMP users, and change authentication passwords and encryption passphrases are not successful. | 4.3.0-5.9.1, 5.10.0-5.10.1 | 5.9.2 |
| 3990258 | Cumulus Linux incorrectly handles unnumbered neighbor types, which causes discrepancies in the running configuration and session flaps during FRR reload. | 5.9.0-5.9.1, 5.10.0-5.10.1 | 5.9.2 |
| 3985600 | NTP initialization issues prevent the NTP service from starting on a non-default VRF. | 5.9.0-5.9.2 | 5.10.0-5.10.1 |
| 3982222 | When SPAN is enabled on a bridge member, an ARP or Gratuitous ARP received during a failover event between locally attached redundant devices such as load balancers might fail to update the bridge MAC table to point to the interface with the newly active load balancer. | 5.4.0-5.9.1 | 5.9.2-5.10.1 |
| 3970626 | When you configure the bridge.kernel_mac_refresh_interval parameter in the switchd.conf file, a switchd restart fails with a core dump. | 5.8.0-5.9.1 | 5.9.2-5.10.1 |
| 3957691 | After a networking restart, ERSPAN mirror sessions might not start. To work around this issue, run the systemctl reload switchd command to start the ERSPAN mirror sessions. | 5.9.0-5.9.1, 5.10.0-5.10.1 | 5.9.2 |
| 3957620 | On a Spectrum-4 switch, if you use PTP on a 800G link, jumbo frames traversing the same link might cause a degradation in PTP performance. | 5.9.0-5.9.1, 5.10.0-5.10.1 | 5.9.2 |
| 3956091 | When you modify the default QoS configuration on top of the base RoCE configuration, NVUE reports an Invalid exception in the nv show qos roce command output even when the configuration is valid. | 5.8.0-5.9.1 | 5.9.2-5.10.1 |
| 3955615 | Cumulus Linux does not recognize QSFP_CMIS optical modules correctly. | 5.6.0-5.9.1 | 5.9.2-5.10.1 |
| 3954026 | Static ARP configured with NVUE commands is deleted when the relevant layer 3 interface flaps. | 5.8.0-5.9.1 | 5.9.2-5.10.1 |
| 3949367 | If you use NVUE to create an SNMP user with a password, then delete and recreate the user with additional encryption passwords (such as DES or AES), SNMP authorization fails for that user. | 5.3.1-5.9.1 | 5.9.2-5.10.1 |
| 3943834 | The default memory configuration for NVIDIA Cumulus VX OVA is too low and needs to be increased. | 5.9.0-5.9.1 | 5.9.2-5.10.1 |
| 3941608 | The default NIC for the VMWare OVA file is set to vmxnet3 instead of e1000. | 5.9.0-5.9.1 | 5.9.2-5.10.1 |
| 3939667 | On NVIDIA Cumulus VX, the password does not reset to the default value of cumulus. | 5.9.0-5.9.1 | 5.9.2-5.10.1 |
| 3929440 | When you enable or disable MLAG configuration on an interface, Cumulus Linux logs LACP partner MAC address and BPDU guard mismatches incorrectly. This issue does not impact functionality. | 5.9.0-5.9.1 | 5.9.2-5.10.1 |
| 3925259 | When you start Cumulus VX in Vagrant with libvirt, VM provisioning might fail with errors that indicate a missing ifup@eth0.service systemd service. | 5.9.0-5.9.1 | 5.9.2-5.10.1 |
| 3917601 | If a packet containing an all zero source MAC address (00:00:00:00:00:00) is learned on the ASIC, switchd sends the learn notification to the kernel but the kernel rejects the MAC address as invalid. The ASIC continuously sends the mac-learn notifications, which wastes CPU resources. To work around this issue, configure ACLs to match on the all-zero source MAC address and drop the invalid packets. | 5.5.0-5.9.1 | 5.9.2-5.10.1 |
| 3917528 | With LACP bypass enabled, Cumulus Linux does not program the MAC address in the bridge FDB for VLAN unaware tagged ports. With EVPN, the address is not advertised and the remote side might flood the packet instead of unicast. | 5.8.0-5.9.1 | 5.9.2-5.10.1 |
| 3915842 | A kernel crash due to memory corruption might occur due to a netfilter error. The log message from netfilter might contain a warning similar to the following:kernel: WARNING: CPU: 1 PID: 0 at net/netfilter/nf_conntrack_core.c:1210 __nf_conntrack_confirm+0x5c7/0x6b0 [nf_conntrack]kernel: RIP: 0010:__nf_conntrack_confirm+0x5c7/0x6b0 [nf_conntrack] | 5.9.0-5.9.1 | 5.9.2-5.10.1 |
| 3915829 | General improvements to overall software stability. | 5.9.0 | 5.9.1-5.10.1 |
| 3904516 | With Optimized Multicast Flooding (OMF), when you unset multiple multicast router ports in a single commit, multicast traffic still floods one of the ports. To work around this issue, unset multicast router ports one by one instead of in a single commit. | 5.9.0-5.9.1 | 5.9.2-5.10.1 |
| 3896967 | PTP does not come up with IPv6 over a trunk port because the IPv6 VLAN tag is not sent. PTP over an IPv4 trunk works fine. | 5.8.0-5.9.1 | 5.9.2-5.10.1 |
| 3895042 | After an NMS station does a full SNMP walk on the switch, you see the following message every 5 minutes:snmp : command not allowed ; TTY=unknown ; PWD=/ ; USER=root ; COMMAND=/usr/cumulus/bin/poectl -j -a This issue occurs because poectl is called on non-PoE switches. To work around this issue, remove or comment out the poetcl call from the /etc/snmpd.conf file, then restart the snmpd process with the sudo systemctl snmpd restart command#snmp ALL = NOPASSWD: /usr/cumulus/bin/poectl -j -a | 4.4.0-5.9.1 | 5.9.2-5.10.1 |
| 3895017 | When ARP suppression is off, remote EVPN VTEPs duplicate ARP packets from local hosts and each remote host receives two copies of the ARP packets. The issue also applies to IPv6 ND packets. | 5.8.0-5.9.1 | 5.9.2-5.10.1 |
| 3890993 | On the NVIDIA spectrum-4 switch, l1-show command output does not show Eye opening information for an interface port. | 5.9.0-5.9.2 | 5.10.0-5.10.1 |
| 3881789 | If you configure the anycast IP address with the nv set nve vxlan mlag shared-address command after you configure MLAG, the anycast IP address configuration is not applied and the VXLAN interface is in a protodown state. To work around this issue, run sudo ifreload -a.To avoid this issue, either apply the anycast configuration before you apply the MLAG configuration or configure the anycast IP address and MLAG together with a single nv config apply command. | 5.9.0-5.9.1 | 5.9.2-5.10.1 |
| 3879635 | ERSPAN port-mirror sessions might not come up after a switchd service restart. To work around this issue and bring up the ERSPAN session, either run switchd reload after a switchd restart or use an ACL-based ERSPAN session. | 5.9.0-5.9.1 | 5.9.2-5.10.1 |
| 3878394 | When ZTP runs a script that contains wget, ZTP fails and you see a message similar to the following:ZTP: ZTP DHCP: Unexpected error: ‘ascii’ codec can’t decode byte 0xe2 in position 181: ordinal not in range(128)ZTP: Script returned failure To work around this issue, use the -q option with wget. | 5.9.0-5.10.1 | |
| 3878166 | The NVUE nv show interface eth0 and nv show vrf commands take more than two minutes to run if you have configured hundreds of interfaces because NVUE makes repetitive system calls to get vlan/link/tunnel bridge information. | 5.9.0-5.9.1 | 5.9.2-5.10.1 |
| 3875589 | MLAG bonds might report an incorrect DOWN reason of lacp partner mac mismatch when the bond is out of service for another reason. | 5.9.0-5.9.1 | 5.9.2-5.10.1 |
| 3873219 | When you remove a port from a bond and add it to the bridge in a single set of NVUE commands, then apply the configuration, the port forwarding state is blocked on all the bridge VLANs. To work around this issue, apply the configuration in two steps. First remove the port from the bond and apply the configuration, then add the port to the bridge and apply the configuration. | 5.9.0-5.9.2 | 5.10.0-5.10.1 |
| 3861745 | On UEFI hardware (where the /sys/firmware/efi directory exists), using the update-grub program might generate a /boot/grub/grub.cfg that is incorrect for booting ONIE if the ONIE option is selected on the console while booting. To work around this issue, run mount LABEL=“EFI System” /boot/efi before using update-grub. | 5.9.0-5.10.1 | |
| 3859422 | On rare occasions when certain events occur, such as changes to the topology in the network, when a bond comes online and directly transits to an STP blocking state, the slave ports might still be in a forwarding state. As a result, traffic is forwarded on a blocked port. | 5.2.0-5.9.1 | 5.9.2-5.10.1 |
| 3854807 | When you enable Optimized Multicast Flooding (OMF) and change VLAN configuration, a few ports might carry multicast traffic even when they are not in the MDB or they are not router ports. | 5.6.0-5.9.1 | 5.9.2-5.10.1 |
| 3854800 | The switch forwards multicast traffic to the CPU when PIM is enabled globally, regardless of the interface configuration. | 5.6.0-5.9.1 | 5.9.2-5.10.1 |
| 3851499 | On the Spectrum A1 switch, when you enable the ip-acl-heavy TCAM profile, VXLAN tunnel initialization might fail. | 5.8.0-5.9.1 | 5.9.2-5.10.1 |
| 3844670 | When you configure TACACS with NVUE or merge in an NVUE configuration file including TACACS configuration with the nv config patch command, you see an unrecoverable error when running additional NVUE commands. To work around this issue, restart the NVUE service with the systemctl restart nvued.service command. | 5.9.0-5.10.1 | |
| 3835635 | When adaptive routing is enabled, traffic for non adaptive routing enabled ports and non adaptive routing ECMPS might be routed over all ports in ECMP. Avoid using regular ECMPs with adaptive routing enabled on the switch. | 5.9.0-5.10.1 | |
| 3821643 | When using SSM and the upstream interface goes away (the source stops sending or the link goes down) the PIMREG interface is added to the outgoing interface list of the S,G and is never removed. As a result, multicast traffic that hits the impacted S,G is forwarded to the CPU and dropped by the switch. | 5.9.0-5.9.1 | 5.9.2-5.10.1 |
| 3775686 | The BGP Suppress Route Advertisement feature under scale (more than 30000 routes) advertises partial updates to downstream neighbors. Because FRR does not read kernel route updates fast enough, the netlink socket receive buffer gets full and further update notifications are dropped. | 5.8.0-5.9.2 | 5.10.0-5.10.1 |
| 3773177 | When you try to upgrade a switch from Cumulus Linux 5.5 or earlier to 5.8.0 or later with package upgrade, you see errors for expired GPG keys that prevent you from upgrading. To work around this issue, install the new keys with the following commands, then upgrade the switch.cumulus@switch:~$ wget https://download.nvidia.com/cumulus/apt.cumulusnetworks.com/repo/pool/cumulus/c/cumulus-archive-keyring/cumulus-archive-keyring_4-cl5.6.0u5_all.deb | 4.0.0-4.4.5, 5.0.0-5.10.1 | |
| 3771168 | When you perform an ISSU upgrade on a Spectrum 1 switch, the switchd service might crash. | 5.8.0-5.10.1 | |
| 3739159 | Disabling adaptive routing globally or on interfaces and performing ISSU, has a significant traffic outage. The issue recovers after ISSU completes. | 5.7.0-5.10.1 | |
| 3711913 | When you set an IPv4 ACL with a log action, logs do not appear under syslog after a match. This issue affects bridged packets when the rule is installed in iptables. To work around this issue, set the ACL with a MAC rule type so that it is installed in ebtables and the packets are logged correctly in syslog.The following shows an example configuration: cumulus@switch:~$ nv set acl one rule 1 action log log-prefix NVIDIA | 5.7.0-5.9.2 | 5.10.0-5.10.1 |
| 3685007 | Cumulus Linux does not support 802.1X dynamic VLANs on PEAP with MS Windows-based supplicants. | 5.7.0-5.10.1 | |
| 3677533 | Due to resource constraints on the Spectrum 1 switch, staticd performance drops and takes longer to read static routes compared to the time BGP takes to complete a graceful restart, and advertise routes and EOR to its helpers. As a result, static routes are advertised after the EOR is sent to graceful restart helpers, which delete the stale static routes and relearn them after receiving the EOR from the restarting node. Temporary traffic loss might occur. | 5.7.0-5.10.1 | |
| 3637444 | Applying an inbound control plane ACL on the eth0 management interface does not take effect. To work around this issue, apply the ACL on the mgmt interface; for example, nv set interface mgmt acl . | 5.7.0-5.10.1 | |
| 3636266 | When an unresolved next hop is present in a next hop group, especially over an SVI interface, the switch checks if the neighbor MAC address is in the forwarding table. If the neighbor’s MAC address is not there, the switch skips this next hop from backend programming and you see the switchd error ERR NH: l3 nhg v6 l3 nhg contains one or more unresolvable nexthops. There is no impact to switch functionality as unresolved neighbors are not programmed in hardware until they are resolved. | 5.7.0-5.9.2 | 5.10.0-5.10.1 |
| 3610591 | After configuring the system level pre-login and post-login banner messages, the messages do not return to their default settings when you run the nv unset system command or the nv config apply empty command. | 5.7.0-5.9.2 | 5.10.0-5.10.1 |
| 3587393 | If you use the NVIDIA SN5600 (Spectrum-4) switch with Ixia test equipment, you might experience delayed link up due to intermittent link flaps. To work around this issue when using copper cables:
To work around this issue when using fiber cables:
| 5.6.0-5.10.1 | |
| 3556762 | On rare occasions, SPT switchover might not happen cleanly in PIM resulting in some dropped packets. If you use PIM-SM to replicate EVPN BUM traffic, you might see a brief drop of multicast traffic before recovering due to normal PIM-SM traffic timeout. | 5.5.0-5.10.1 | |
| 3538321 | In rare cases, an STP topology change on PTP over a VLAN can result in the switch losing the slave state and one of the ports might remain in an uncalibrated state. To work around this issue, toggle the port that is in the uncalibrated state up and down so that one of the ports is selected as the slave. | 5.6.0-5.10.1 | |
| 3452681 | When you run the NVUE nv show system aaa tacacs authorization commands to show per command authorization for a specific TACACS+ user privilege level, you see an error message similar to Error: GET /nvue_v1/system/aaa/tacacs/authorization/1?rev=operational responded with 404 NOT FOUND. | 5.5.0-5.10.1 | |
| 3442569 | When trying to access the NVUE API, user accounts authenticated with a newly-configured external service, such as TACACS, RADIUS, or LDAP, receive a 401 forbidden error. To work around this issue, after enabling a new authentication service, make sure to restart both nginx.service and nvued.service to begin authenticating users against the new authentication service. | 5.5.0-5.10.1 | |
| 3424967 | sudo for TACACS+ users with privilege level 15 does not work when reaching the TACACS+ server through the default VRF. To work around this issue, specify the interface name that the default VRF uses in the vrf= setting of the /etc/tacplus_servers file or run the NVUE nv set system aaa tacacs vrf command. If you don’t run either command, a TACACS+ user with privilege level 15 can run vrf task exec default sudo … to execute the sudo command. | 5.0.0-5.10.1 | |
| 3420056 | The ADVA 5401 SFP module with hardware revision 5.01 does not come up at layer 1 when you use 10G QSA adaptors. To work around this issue, use 25G QSA adaptors. | 4.4.0-4.4.5, 5.0.0-5.10.1 | |
| 3393966 | When you configure OSPF network statements using NVUE with the nv set vrf command, subsequent configuration changes with NVUE might bring down all OSPF neighbors. To work around this issue, create an NVUE snippet to configure the network statement, or use the nv set interface command to enable OSPF on interfaces instead of using a network statement. | 5.5.0-5.9.2 | 5.10.0-5.10.1 |
| 3362113 | If you restore an NVUE startup.yaml file or run the nv config patch command after an upgrade that includes breakout ports with QoS configuration, the NVUE configuration fails to apply. Subsequent attempts to run nv config apply fail with a message similar to Invalid config [rev_id: 11] qos config is not supported on the following invalid interface: swp1s0. Supported on swp and bond interface types. To work around this issue, run nv unset on the configured QoS settings, then apply the breakout port configuration before you configure QoS. Alternatively, you can remove the QoS configuration from the yaml file and patch it separately after applying the breakout configuration. | 5.4.0-5.10.1 | |
| 3347538 | When connecting NVIDIA-to-NVIDIA in PAM4, you must enable auto-negotiation. | 5.4.0-5.10.1 | |
| 3341214 | If you use the NVUE REST API to configure a local user with a hashed password, the user cannot log in and the /etc/nvue.d/startup.yaml file shows the password as plain text. | 5.4.0-5.10.1 | |
| 3329518 | When using TACACS+, if the /etc/nsswitch.conf file specifies passwd: files tacplus (files is listed before tacplus), a user that is present in both the local /etc/passwd file and the TACACS+ server cannot log into the switch. NVIDIA recommends that when using TACACS+, you list tacplus before files in /etc/nsswitch.conf. When using NVUE, ensure that tacacs has priority over local. | 5.4.0-5.10.1 | |
| 3327477 | If you use su to change to a user specified through TACACS+, the user becomes the local tacacs0 thru tacacs15 user instead of the named user to run sudo commands. As a result, the named user password might not match the local tacacs0 thru tacacs15 user password. | 3.7.0-3.7.16, 4.0.0-4.4.5, 5.0.0-5.10.1 | |
| 3326659 | If you have a large number of MAC addresses, they do not age out at the MAC ageing timeout value configured on the switch. It might take up to 30 seconds more for the MAC addresses to age out and be deleted from the hardware. To work around this issue, wait for the ageing timeout value plus 30 seconds. | 5.4.0-5.10.1 | |
| 3241567 | When you apply switch configuration for the first time on a freshly booted switch and you run the nv config apply command after setting the hostname with nv set system hostname, you might see the error message Failed to start Hostname Service. To work around this issue, run the nv config apply command a second time. | 5.3.0-5.10.1 | |
| 3226506 | The l1-show eth0 command does not show port information and is not supported in this release. | 5.3.0-5.10.1 | |
| 3172504 | When you connect the NVIDIA SN4600C switch to a Spectrum 1 or Spectrum-3 switch with a 40GbE passive copper cable (Part Number: MC2210126-005) on edge ports 1-4 and 61-64, there is an Effective BER of 1E-12 in PHY. | 5.2.0-5.10.1 | |
| 3147782 | You cannot use NVUE to configure an SNMP view to include a subtree beginning with a period. For example:cumulus@switch:~$ nv set service snmp-server viewname cumulusOnly included .1.3.6.1.4.1.40310Error: GET /nvue_v1/service/snmp-server/viewname/cumulusOnly/included?pointers=%5B%22%2Fparameters%22%2C+%22%2Fpatch%2FrequestBody%2Fcontent%2Fapplication~1json%2Fschema%22%2C+%22%2Fpatch%2Fparameters%22%2C+%22%2Fpatch%2Fresponses%2F200%2Flinks%22%5D responded with 404 NOT FOUNDTo work around this issue, reference the OID without the preceding period ( . ) in the command. | 5.3.0-5.10.1 | |
| 3145869 | On a Spectrum-3 switch, the PTP offset in 10GbE changes between +-27. The average offset is around 7. | 5.2.0-5.10.1 | |
| 3135952 | PAM4 split cables (such as 2x100G, 4x100G, and 4x50G) do not work with a forced speed setting (when auto-negotiation is off) as the default speed enabled is for NRZ mode (such as 100G_4X). To work around this issue, set the appropriate lanes for forced speed (with auto-negotation off) with the ethtool -s swpX speed <port_speed> autoneg off lanes <no_of_lanes> command. For example:cumulus@switch:~$ sudo ethtool -s swp1 speed 100000 autoneg off lanes 2 | 5.2.0-5.10.1 | |
| 3122301 | On the NVIDIA SN4700 switch, inserting and removing the PSU might cause loss of frames. | 5.2.0-5.10.1 | |
| 3115242 | When you configure two VNIs in the same VLAN, ifupdown2 shows a vlan added to two or more VXLANS warning, which is only issued after the VNI is already added to the bridge. This leaves the new VNI in the PVID even if there is already an existing VNI configured in that PVID. | 5.1.0-5.10.1 | |
| 3103821 | On the NVIDIA SN4700 switch, inserting and removing the PSU might cause loss of frames. | 5.2.0-5.10.1 | |
| 3084476 | After you disable traffic shaping in the /etc/cumulus/datapath/qos/qos_features.conf file, the default QOS traffic shaping configuration does not restore. To work around this issue, restart switchd. | 4.4.3, 5.0.0-5.10.1 | 4.4.4-4.4.5 |
| 3084027 | Under a high load, you might see ingress drop counters increase. The drops are classified as HwIfInDiscards in ethtool and shown as ingress_general in hardware. | 4.3.0-4.4.5, 5.0.0-5.10.1 | |
| 3071652 | On rare occasions, after you reboot or restart switchd on a Spectrum 1 switch, any 25G connections with Direct Attach Copper (DAC) cables that connect from the switch to a non-NVIDIA device might flap continuously. To work around this issue, bring the affected link administratively down for a few seconds on the non-NVIDIA device, then bring the link back up. | 4.4.4-4.4.5, 5.1.0-5.10.1 | |
| 3061656 | When the CPU load is high during a warm boot, bonds with a slow LACP rate fail to forward layer 2 traffic for up to 60 seconds (depending on the duration of the CPU load) and static bonds fail to forward layer 2 traffic for up to 5 seconds. | 5.1.0-5.10.1 | |
| 3053094 | When the CPU load is high during a warm boot, bonds with a slow LACP rate fail to forward layer 2 traffic for up to 60 seconds (depending on the duration of the CPU load) and static bonds fail to forward layer 2 traffic for up to 5 seconds. | 5.1.0-5.10.1 | |
| 2972540 | With RADIUS enabled for user shell authentication, there might be a delay in local user authentication for non cumulus user accounts. | 5.0.0-5.10.1 | |
| 2964279 | When a VNI flaps, an incorrect list of layer 2 VNIs are associated with a layer 3 VNI. The NCLU net show evpn vni detail command output shows duplicate layer 2 VNIs under a layer 3 VNI. | 3.7.15, 4.4.2-4.4.5, 5.0.0-5.10.1 | 3.7.16 |
| 2951110 | The net show time ntp servers command does not show any output with the management VRF. | 3.7.15-3.7.16, 4.1.1-4.4.5, 5.0.0-5.10.1 | |
| 2904450 | When you run the ethtool -m or the l1-show command, the 400G interface optical values do not show. | 4.4.0-4.4.5, 5.0.0-5.10.1 | |
| 2891255 | CVE-2021-39925: Buffer overflow in the Bluetooth SDP dissector in Wireshark 3.4.0 to 3.4.9 and 3.2.0 to 3.2.17 allows denial of service via packet injection or crafted capture file. Vulnerable: <= 2.6.20-0+deb10u1 Fixed: 2.6.20-0+deb10u2 | 4.0.0-4.4.1, 5.0.0-5.10.1 | 4.4.2-4.4.5 |
| 2890681 | CVE-2021-42771: relative path traversal in Babel, a set of tools for internationalising Python applications, could result in the execution of arbitrary code Vulnerable: 2.6.0+dfsg.1-1Fixed: 2.6.0+dfsg.1-1+deb10u1 | 4.0.0-4.4.1, 5.0.0-5.10.1 | 4.4.2-4.4.5 |
| 2867042 | When connecting the NVIDIA SN4600 switch to another NVIDIA Spectrum switch, you must use auto-negotiation mode (not force mode); otherwise the switch might use the wrong Tx configuration. | 5.0.0-5.10.1 | |
| 2847755 | When you use NCLU to remove the configuration for a peer that is a member of a group but also has other peer-specific configuration, you must remove the peer-specific configuration before you delete the peer in a separate NCLU commit. | 5.0.0-5.10.1 | |
| 2823307 | Cumuls Linux does not support a bond with more than 64 ports. Any configuration with more than 64 ports in a bond changes all ports to down when you apply the configuration. | 5.0.0-5.10.1 | |
| 2736108 | When you change the VRRP advertisement interval on the master, the master advertisement interval field in the show vrrp command output does not show the updated value. | 4.4.0-4.4.5, 5.0.0-5.10.1 | |
| 2684925 | The NVUE nv show vrf default router bgp peer command produces a 404 not found error. | 4.4.0-4.4.5, 5.0.0-5.10.1 | |
| 2671652 | In VXLAN routing environments, you might experience sub-optimal route convergence delays (longer than five seconds) when a prefix transitions to a new ECMP next-hop group. This condition might occur when a VTEP loses ECMP routes through all uplink peerings, then installs the routes through a different path, such as an MLAG peerlink. | 4.4.0-4.4.5, 5.5.0-5.10.1 | |
| 2543915 | When you enable a service in the management VRF, systemctl issues a warning similar to the following:Warning: The unit file, source configuration file or drop-ins of ntp@mgmt.service changed on disk. Run ‘systemctl daemon-reload’ to reload unitYou can safely ignore this warning. | 4.0.0-5.9.2 | 5.10.0-5.10.1 |
Fixed Issues in 5.9.0
| Issue ID | Description | Affects |
|---|---|---|
| 3875419 | The cleanup scrip inadvertently removes the active LTTng session directory used by lttng-sessiond for trace dumping. This issue occurs under specific conditions when more than five LTTng trace folders are present, leading to intermittent failures in trace logging. To work around this issue, manually move the timestamped lttng logs to a different directory. | 5.8.0 |
| 3863858 | VRR interfaces might show dadfailed on their IPv6 link-local address. | 5.6.0-5.8.0 |
| 3863063 | When simultaneously changing the maxage and forward-delay bridge timers in RSTP for VLAN-aware bridges, the commands might not be accepted if the 2xfdelay-1 is less than the previously configured maxage timer because ifupdown2 configures the forward delay first.To work around this issue, run the ifreload -a command again to process the forward-delay command after the new maxage configuration has been accepted.You have to repeat the ifreload -a command after a reboot to set the forward delay correctly in the bridge. | 5.8.0 |
| 3837121 | With a large route map and community list configuration, FRR reload takes much longer than normal (approximately 13 seconds) and in some cases, CPU utilization is high. | 5.8.0 |
| 3832116 | When you configure a SPAN session either with the NVUE nv set system port-mirror session command or in the /etc/cumulus/switchd.d/port-mirror.conf file and the default route is configured to 0.0.0.0/0, the SPAN session might not work as expected. To work around this issue, remove the default route 0.0.0.0/0 and use alternate routes instead. | 5.7.0-5.8.0 |
| 3828243 | After you change the remote AS for a peer group, the switch no longer has any peers associated with the peer group. To work around this issue, reconfigure all the associated peers after you change the remote AS for the peer group. | 5.8.0 |
| 3824750 | With the nvidia.nvue Ansible module, NVUE honors input from the Ansible module only; if you do not provide the full configuration, NVUE generates an exception. To work around this issue, always provide the full configuration. | 5.6.0-5.8.0 |
| 3813710 | The What Just Happened service (wjhd) fails to start if an interface alias (description) contains the text Ethernet and add syslog messages similar to the following:router1: wjhd: exception: stoirouter1: wjhd: Fail to deinit SDK telemetry, error: [3]: [Invalid Handle] | 5.8.0 |
| 3812857 | When enabling telemetry on an interface, NVUE doesn’t validate if some of the configuration is correct. For example if you configure swp1s0, but enter swp1 by mistake, NVUE accepts and applies this configuration. If the ASIC monitor service finds that this port is not available, it skips the configuration associated with this port. NVUE applies configuration for other valid ports as expected. | 5.8.0 |
| 3800536 | Some third-party modules cause false-alarm interrupts during SERDES tuning, which overloads the ASIC and causes an ASIC response delay. | 5.8.0 |
| 3798580 | With ROCE enabled, LLDP DCBX TLVs might carry an incorrect PFC map when bond interfaces are present on the switch. | 5.8.0 |
| 3782996 | If you have installed a large number ACLs, you might see a switchd memory leak over a period of time that stops the switchd process because it is out of memory . | 5.6.0-5.8.0 |
| 3782543 | When you configure the BGP setting bgp max-med on-startup with vtysh, the MED on some peers might not be set to 4294967294 as expected on startup. The max-med might also fail to reset after the startup timer expires. | 5.6.0-5.8.0 |
| 3775648 | Enabling or disabling link utilization causes the switchd service to restart, which causes all network ports to reset, interrupts network services, and resets the switch hardware configuration. | 5.8.0 |
| 3773991 | When you use warm mode to reboot a switch with a large number of EVPN routes and BGP graceful restart is enabled, stale routes might be relearned from BGP neighbors after the switch boots. This might cause traffic loss until BGP is fully converged after the reboot. | 5.8.0 |
| 3770993 | When a supplicant is authorized successfully on an interface in 802.1x multi-host mode, ping traffic coming into the 802.1x interface towards a local SVI might not be successful. | 5.8.0 |
| 3770865 | On the NVIDIA SN5600 switch, performing a fresh image install or a power cycle can cause the PCIE link speed to get downgraded from Gen3(8GTs) to Gen1(2.5GTs). To recover, reboot the switch. | 5.8.0 |
| 3767037 | When you try to upgrade a switch from Cumulus Linux 5.5 or earlier to 5.8.0 with package upgrade, you see errors for expired GPG keys that prevent you from upgrading. To work around this issue, install the new keys with the following commands, then upgrade the switch.cumulus@switch:~$ sudo apt-get updatecumulus@switch:~$ sudo apt-get install –allow-unauthenticated cumulus-archive-keyring | 5.8.0 |
| 3765395 | The nv unset nve vxlan flooding and nv set nve vxlan flooding enable off commands do not disable BUM flooding. To work around this issue, disable BUM flooding with vtysh commands:leaf01# configure terminal | 5.5.0-5.8.0 |
| 3759515 | After upgrading to Cumulus Linux 5.8, MLAG reports bonds as bpdu guard mismatch. To work around this issue, restart the MLAG service with the systemctl restart clagd on the device that reports the conflict. | 5.8.0 |
| 3753050 | On Spectrum 1 switches, switchd might crash due to an SDK health event or error. | 5.6.0-5.8.0 |
| 3752266 | If you configure DHCP Server HA, the switch failover might cause the DHCP service to report a time mismatch too great error. | 5.7.0-5.8.0 |
| 3744830 | When configured with NVUE, the Radius secret key can be a maximum of 19 characters long. | 5.7.0-5.8.0 |
| 3739008 | The Lenovo MSN4600-VS2RC (PN SSG7B27990 Back-to-Front/C2P Airflow) might run the fan tray fans at a high speed because the software believes the PSU fans are running in the wrong direction. | 5.5.1-5.8.0 |
| 3730904 | When sending untagged frames to the CPU with an MTU higher than the SVD (single VXLAN device) MTU, the kernel might crash. | 5.4.0-5.8.0 |
| 3702431 | Traditional SNMP snippets do not take effect unless you first enable SNMP with the NVUE nv set service snmp-server enable on and nv set service snmp-server listening-address commands. Alternatively, you can use the equivalent REST API methods. | 5.4.0-5.8.0 |
| 3679478 | During switch boot, you see the following messages in the syslog:2024-03-04T10:34:49.650950+00:00 cumulus sx_sdk: 2262 [TELE] [ERROR ]: Tele impl module is already initialized2024-03-04T10:34:49.651041+00:00 cumulus sx_sdk: 2262 [TELE] [ERROR ]: sdk_tele_init failed, for chip type CHIP_TYPE_SWITCH_SPECTRUM3, err = Already initialized This is due to both the ASIC Monitoring service and the What Just Happened (WJH) service trying to initialize the SDK TELE module. You can ignore the messages because the TELE service has already initialized properly. | 5.7.0-5.8.0 |
| 3672706 | When you enable port security, you can configure a maximum of 450 port security static MAC addresses for an interface. | 5.7.0-5.8.0 |
| 3610967 | In an EVPN symmetric routing configuration, running the NVUE nv set vrf command to derive layer 3 VNIs automatically might result in duplicate VLAN entries in the system. This most often occurs at scale when many VRFs have similar names. To work around this issue, manually specify a unique VLAN for each VRF. | 5.3.0-5.8.0 |
| 3546857 | The nv show bridge vlan command does not show tagged and untagged VLAN information for the bridge | 5.6.0-5.8.0 |
| 3541653 | During warm boot with layer 3 traffic, you might experience packet loss for approximately 15 milliseconds. | 5.6.0-5.8.0 |
| 3484058 | When you power on the NVIDIA SN3420 switch with no connected cables, the QSFP ports LEDs light in amber. | 5.3.0-5.8.0 |
| 3463827 | On rare occasions, SPT switchover might not happen cleanly in PIM, resulting in some dropped packets. If you use PIM-SM to replicate EVPN BUM traffic, you might see a brief drop of multicast traffic before recovering due to normal PIM-SM traffic timeout. | 5.6.0-5.8.0 |
| 3433577 | When you use a single VXLAN device (SVD) with MLAG and static VXLAN tunnels, Cumulus Linux incorrectly associates the MAC addresses it learns from the VXLAN fabric to the bridge PVID. This issue can lead to a feedback loop between the clagd service and switchd, and might result in critical CPU usage with an out of memory condition. Do not use an SVD when enabling MLAG in a static VXLAN environment. | 5.5.0-5.8.0 |
| 3141826 | A slow memory leak (~5KB over 24 hour period at a 60 second polling interval) might occur in SNMP when you walk the following system MIB objects (1.3.6.1.2.1) 1.3.6.1.2.1.47 –> Entity MIB 1.3.6.1.2.1.99 –> Entity Sensor MIB 1.3.6.1.2.1.23 –> rip2 1.3.6.1.2.1.2 –> interface/interfaces 1.3.6.1.2.1.31 –> ifMIB 1.3.6.1.2.1.4 –> IP 1.3.6.1.2.1.25 –> hostResource | 5.0.1-5.8.0 |