Skip to content

NewValidation for CSCwp91797 #293

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
welkinhe wants to merge 5 commits into
base: v4.2.0-dev
Choose a base branch
from
Open

NewValidation for CSCwp91797 #293

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
e56ac4e
Introduced port tracking minimal uplink check.
welkinhe Oct 31, 2025
59240cd
Updated test case and documentation.
welkinhe Oct 31, 2025
dd726be
Update docs
welkinhe Oct 31, 2025
8af0533
Doc URL fix.
welkinhe Oct 31, 2025
8deb412
Updated headers to include "Admin State".
welkinhe Nov 2, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
28 changes: 28 additions & 0 deletions aci-preupgrade-validation-script.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5558,6 +5558,33 @@ def configpush_shard_check(tversion, **kwargs):

return Result(result=result, headers=headers, data=data, recommended_action=recommended_action, doc_url=doc_url)

@check_wrapper(check_title='Port Tracking Minimal Uplink Zero')
def port_tracking_active_fabric_port_check(tversion, **kwargs):

@monrog2 monrog2 Jul 22, 2026

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[Medium] No-vPC fabrics receive a false outage warning

CSCwp91797 affects vPC physical member ports, but this check does not consume the already available vpc_node_ids. A fabric with no vPC can therefore receive FAIL_O and unnecessary remediation guidance. Accept vpc_node_ids, return N/A before querying when no vPC topology exists, and add tests for empty and populated vPC inventories.

result = NA
headers = ["Admin State", "Port Tracking Active Fabric Ports"]
data = []
recommended_action = 'Increase Port Tracking Active Fabric Ports to 1 before upgrade'

@monrog2 monrog2 Jul 22, 2026

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[High] Recommended change omits its safety prerequisite

The authoritative CSCwp91797 guidance makes minlinks=1 conditional on sufficient fabric-uplink redundancy and provides disabling port tracking before upgrade as an alternative. This unconditional instruction can cause service impact on an unsuitable leaf. Include the prerequisite and supported alternatives, or direct users to the authoritative procedure/TAC when suitability cannot be verified. Assert the complete recommendation and result payload in tests.

doc_url = 'https://datacenter.github.io/ACI-Pre-Upgrade-Validation-Script/validations/#port-tracking-active-fabric-port-zero'

if not tversion:
return Result(result=MANUAL, msg=TVER_MISSING)

if tversion.same_as("6.0(9d)"):

@monrog2 monrog2 Jul 22, 2026

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[Blocking] Confirmed affected releases are classified N/A

This exact-version gate skips 6.1(3f), which the authoritative CSCwp91797 release note explicitly identifies as affected, and the record indicates additional affected releases exist. Those targets currently return N/A without evaluating the policy, hiding an outage risk. Reconcile the train-specific affected/fixed matrix with the defect owner, encode all authoritative boundaries, update the documentation, and test 6.0(9d), 6.1(3f), each known fixed boundary, and adjacent releases.

result = PASS
port_tracking_api = 'uni/infra/trackEqptFabP-default.json'
port_tracking_mo = icurl('mo', port_tracking_api)
if port_tracking_mo:
admin_st = port_tracking_mo[0]['infraPortTrackPol']['attributes']['adminSt']

@monrog2 monrog2 Jul 22, 2026

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[Blocking] Empty policy response produces a false PASS

result is set to PASS before this query, so an empty successful response leaves the check passing even though the required singleton policy was never evaluated. The same path also assumes exactly one correctly shaped object. Treat empty, duplicate, wrong-class, or attribute-incomplete responses as ERROR; only return PASS after evaluating exactly one valid infraPortTrackPol. Add empty, malformed, and duplicate-response tests that assert both Result and AciResult output.

minimal_uplink = port_tracking_mo[0]['infraPortTrackPol']['attributes']['minlinks']
if admin_st == "on" and minimal_uplink == "0":
data.append([admin_st,minimal_uplink])
else:
return Result(result=NA, msg=VER_NOT_AFFECTED)
if data:
result = FAIL_O

return Result(result=result, headers=headers, data=data, recommended_action=recommended_action, doc_url=doc_url)

# ---- Script Execution ----


Expand Down Expand Up @@ -5719,6 +5746,7 @@ def get_checks(api_only, debug_function):
standby_sup_sync_check,
isis_database_byte_check,
configpush_shard_check,
port_tracking_active_fabric_port_check,

]
conn_checks = [
Expand Down
11 changes: 10 additions & 1 deletion docs/docs/validations.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -190,7 +190,8 @@ Items | Defect | This Script
[Observer Database Size][d25] | CSCvw45531 | :white_check_mark: | :no_entry_sign:
[Stale pconsRA Object][d26] | CSCwp22212 | :warning:{title="Deprecated"} | :no_entry_sign:
[ISIS DTEPs Byte Size][d27] | CSCwp15375 | :white_check_mark: | :no_entry_sign:
[Policydist configpushShardCont Crash][d28] | CSCwp95515 | :white_check_mark: |
[Policydist configpushShardCont Crash][d28] | CSCwp95515 | :white_check_mark: | :no_entry_sign:
[Port Tracking Active Fabric Port Zero][d29] | CSCwp91797 | :white_check_mark: |

[d1]: #ep-announce-compatibility
[d2]: #eventmgr-db-size-defect-susceptibility
Expand Down Expand Up @@ -220,6 +221,7 @@ Items | Defect | This Script
[d26]: #stale-pconsra-object
[d27]: #isis-dteps-byte-size
[d28]: #policydist-configpushshardcont-crash
[d29]: #port-tracking-active-fabric-port-zero


## General Check Details
Expand Down Expand Up @@ -2603,6 +2605,12 @@ Due to [CSCwp95515][59], upgrading to an affected version while having any `conf

If any instances of `configpushShardCont` are flagged by this script, Cisco TAC must be contacted to identify and resolve the underlying issue before performing the upgrade.

### Port Tracking Active Fabric Port Zero

Due to [CSCwp91797][62], if port-tracking feature is on and "number of active fabric ports that triggers port tracking" is zero, vPC member may be showing down post upgrade, the interface status become "initializing" by CLI "show interface e1/xx"

This defect is only applicable to 6.0(9d), change port-tracking "number of active fabric ports that triggers port tracking" to 1 before upgrade can avoid this issue.


[0]: https://github.com/datacenter/ACI-Pre-Upgrade-Validation-Script
[1]: https://www.cisco.com/c/dam/en/us/td/docs/Website/datacenter/apicmatrix/index.html
Expand Down Expand Up @@ -2666,3 +2674,4 @@ If any instances of `configpushShardCont` are flagged by this script, Cisco TAC
[59]: https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwp95515
[60]: https://www.cisco.com/c/en/us/solutions/collateral/data-center-virtualization/application-centric-infrastructure/white-paper-c11-743951.html#Inter
[61]: https://www.cisco.com/c/en/us/solutions/collateral/data-center-virtualization/application-centric-infrastructure/white-paper-c11-743951.html#EnablePolicyCompression
[62]: https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwp91797
30 changes: 30 additions & 0 deletions tests/port_tracking_active_fabric_port_check/infraPortTrackPol_neg.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,30 @@
{
"totalCount": "1",
"imdata": [
{
"infraPortTrackPol": {
"attributes": {
"adminSt": "off",
"annotation": "",
"childAction": "",
"delay": "120",
"descr": "",
"dn": "uni/infra/trackEqptFabP-default",
"extMngdBy": "",
"includeApicPorts": "no",
"lcOwn": "local",
"minlinks": "0",
"modTs": "2025-10-31T17:13:46.220+11:00",
"name": "default",
"nameAlias": "",
"ownerKey": "",
"ownerTag": "",
"rn": "trackEqptFabP-default",
"status": "",
"uid": "0",
"userdom": "all"
}
}
}
]
}
30 changes: 30 additions & 0 deletions tests/port_tracking_active_fabric_port_check/infraPortTrackPol_neg1.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,30 @@
{
"totalCount": "1",
"imdata": [
{
"infraPortTrackPol": {
"attributes": {
"adminSt": "on",
"annotation": "",
"childAction": "",
"delay": "120",
"descr": "",
"dn": "uni/infra/trackEqptFabP-default",
"extMngdBy": "",
"includeApicPorts": "no",
"lcOwn": "local",
"minlinks": "1",
"modTs": "2025-10-31T17:13:46.220+11:00",
"name": "default",
"nameAlias": "",
"ownerKey": "",
"ownerTag": "",
"rn": "trackEqptFabP-default",
"status": "",
"uid": "0",
"userdom": "all"
}
}
}
]
}
30 changes: 30 additions & 0 deletions tests/port_tracking_active_fabric_port_check/infraPortTrackPol_pos.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,30 @@
{
"totalCount": "1",
"imdata": [
{
"infraPortTrackPol": {
"attributes": {
"adminSt": "on",
"annotation": "",
"childAction": "",
"delay": "120",
"descr": "",
"dn": "uni/infra/trackEqptFabP-default",
"extMngdBy": "",
"includeApicPorts": "no",
"lcOwn": "local",
"minlinks": "0",
"modTs": "2025-10-31T17:13:46.220+11:00",
"name": "default",
"nameAlias": "",
"ownerKey": "",
"ownerTag": "",
"rn": "trackEqptFabP-default",
"status": "",
"uid": "0",
"userdom": "all"
}
}
}
]
}
49 changes: 49 additions & 0 deletions tests/port_tracking_active_fabric_port_check/test_port_tracking_active_fabric_port_check.py
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,49 @@
import os
import pytest
import logging
import importlib
from helpers.utils import read_data
script = importlib.import_module("aci-preupgrade-validation-script")
log = logging.getLogger(__name__)
dir = os.path.dirname(os.path.abspath(__file__))
infra_port_track_pol_api = 'uni/infra/trackEqptFabP-default.json'
@pytest.mark.parametrize(
"icurl_outputs, tversion, expected_result",
[
# tversion not given
(
{infra_port_track_pol_api: []},
None,
script.MANUAL,
),
# tversion is not hit
(
{infra_port_track_pol_api: []},
"6.0(9e)",
script.NA,
),
#adminSt is off.
(
{infra_port_track_pol_api: read_data(dir, "infraPortTrackPol_neg.json")},
"6.0(9d)",
script.PASS,
),
#adminSt is on, but minlinks is not zero.
(
{infra_port_track_pol_api: read_data(dir, "infraPortTrackPol_neg1.json")},
"6.0(9d)",
script.PASS,
),
#adminSt is on, and minlinks is zero.
(
{infra_port_track_pol_api: read_data(dir, "infraPortTrackPol_pos.json")},
"6.0(9d)",
script.FAIL_O,
)
],
)

def test_logic(mock_icurl, tversion, expected_result):
tversion = script.AciVersion(tversion) if tversion else None
result = script.port_tracking_active_fabric_port_check(1, 1, tversion)
assert result == expected_result