diff --git a/content/cumulus-linux-518/Whats-New/rn.md b/content/cumulus-linux-518/Whats-New/rn.md index a115599142..8b55450e62 100644 --- a/content/cumulus-linux-518/Whats-New/rn.md +++ b/content/cumulus-linux-518/Whats-New/rn.md @@ -9,179 +9,6 @@ type: rn pdfhidden: True --- {{}} -## 5.18.1 Release Notes -### Open Issues in 5.18.1 - -| Issue ID | Description | Affects | Fixed | -|--- |--- |--- |--- | -| 5240456 | BGP peer sessions might repeatedly flap and re-establish. During outbound TCP connect, the BGP service might clear the local nexthop information for the peer and fail nexthop setup when the remote endpoint is not yet available, which resets the session. Logs might show nexthop_set failed with remote: (null) and Transport endpoint is not.... | 5.16.1-5.18.1 | | -| 5224270 | On switches with TACACS+ servers configured by hostname (FQDN) instead of IP address, the switch might generate an excessive rate of DNS queries for the configured TACACS+ server names, including for local user or UID lookups that never actually need to contact a TACACS+ server. | 5.16.1-5.18.1 | | -| 5220910 | NVUE accepts invalid telemetry snapshot file paths; however, the corresponding show commands fail with an error in the NVUE logs. | 5.18.0-5.18.1 | | -| 5217091 | In some scenarios after configuration bring-up or an interface carrier transition, traffic might not be forwarded on some interfaces in an ECMP group. To work around this issue, flap the affected interface. | 5.18.0-5.18.1 | 5.16.7| -| 5215333 | If you provide a value that contains a non-ASCII character in NVUE, you see an unhandled Python exception instead of a normal CLI validation error. | 5.18.0-5.18.1 | | -| 5199525 | When EVPN prefixes learned from a BGP neighbor are withdrawn, the gNMI EVPN installed-prefix count does not decrease. | 5.16.1-5.18.1 | | -| 5197214 | If the cumulus-platform-common package is updated, login notification might fail on each login and show errors. | 5.18.0-5.18.1 | | -| 5190122 | On a Spectrum-6 switch (such as the SN6600-LD), gNMI reports an incorrect shared-buffer cell size of 192 bytes at /qos/shared-buffer/state/cell-size instead of the correct 256 bytes for Spectrum-6. Because this cell size is used to convert internal buffer cell counts into byte values, several shared-buffer telemetry values derived from it (such as per-queue or traffic-class buffer usage and maximum occupancy) report incorrectly over gNMI. The values are inconsistent with the values that NVUE reports and the hardware buffer counters. | 5.18.0-5.18.1 | | -| 5185670 | NVUE incorrectly formats the usb0 operational link attributes as speed 0G and oper-status unknown. | 5.18.0-5.18.1 | | -| 5185505 | On the Spectrum-6 switch, NVUE fails to display per-interface counters for usb0 although the interface and its counters are shown in the global counters view. | 5.18.0-5.18.1 | | -| 5184005 | In certain SRv6 configuration rollback scenarios, Zebra might fail to restore all explicit SRv6 SIDs. This can occur when multiple SRv6 locators share the same parent SID block and one of the locators is replayed during rollback. To work around this issue, restart FRR to clear the stale in-memory SRv6 SID allocation state, then reapply the intended configuration if needed. | 5.18.0-5.18.1 | | -| 5183654, 5234851 | When you upgrade gNMI with package upgrade, the nv-gnmi.service fails and the switch collects a tech support bundle after the first step of the process (nv action upgrade system packages to latest. The package upgrade process triggers a switch reboot straight afterwards as a second and final step. There is no functional impact after switch reboot completes. | 5.18.0-5.18.1 | | -| 5183442 | If the running version of Cumulus Linux is not the newest, installing packages in cumulus-local-apt-archive (RADIUS or TACACS+ packages) might bring in a newer version from remote locations that does not match the running version of Cumulus Linux. To avoid this problem add an /etc/apt/preferences.d/10_prefer_cumulus_local_apt_archive file with the following content (if not already present) before doing a package update:
Package: *
Pin: release a=cumulus-local-apt-archive
Pin-Priority: 992
| 5.16.3-5.18.1 | | -| 5180032, 5180016 | Running a transceiver query with the ethtool -m or nv show interface transceiver command might intermittently discard the reply, causing the command to hang for approximately 30 seconds and fail with netlink error: Connection timed out before recovering. | 5.18.0-5.18.1 | | -| 5177678 | In an EVPN deployment using downstream VNIs (D-VNIs), when all EVPN route-target imports are withdrawn from a VRF, switchd fails to free exactly one of the D-VNI entries. | 5.18.0-5.18.1 | | -| 5174873 | On an EVPN MH topology with route leaking, if we enable Layer 3 VXLAN Device Mode from existing Single VXLAN Device for All Layer 3 VNIs model, FDB/mac entry is not installed in hardware for some remote VTEP router macs. This affects L3 VxLAN traffic through the VTEPs whose RMACs are not installed on the DUT. | 5.18.0-5.18.1 | | -| 5174595, 5233487 | On an EVPN MH topology with route leaking, if we enable Layer 3 VXLAN Device Mode from existing Single VXLAN Device for All Layer 3 VNIs model, cl-route-check errors are observed. Neighbor entry is not resolved for the next hop and hence traffic on the routes shown in cl-route-check errors will be impacted. | 5.18.0-5.18.1 | | -| 5170159 | NAS IP addresses are missing from RADIUS accounting packets. | 5.18.0-5.18.1 | | -| 5167882 | In rare cases switchd crashes and the cl-support file triggers twice, which interrupts legacy mlxlink collection and causes multiple per port mlxlink support files to generate. | 5.16.1-5.18.1 | | -| 5165432, 5154620 | With EVPN L3VXI mode enabled, routes leaked between tenant vrfs (using import vrfs) are installed without the encap info leading to blackholing of the traffic. | 5.18.0-5.18.1 | | -| 5159852, 4667526 | When you configure multiple parallel IPv6 numbered eBGP sessions between the same pair of switches, some sessions can remain in an Idle state during simultaneous link or session bringup. Affected sessions repeatedly report Cease/Connection Collision Resolution. To work around this issue, configure update-source separately for every numbered IPv6 BGP neighbor on both switches, using the local IPv6 address assigned to that neighbor’s link.
Do not configure a single shared source on the peer group when each parallel link has a different local address. After applying the configuration, clear the affected BGP sessions to remove any existing incorrectly associated connections. | 5.18.0-5.18.1 | | -| 5159368, 5170404 | When the Spectrum 1 switch with scaled configuration collects a cl-support file, the collection might timeout for certain modules and lose system and networking data. | 5.18.0-5.18.1 | | -| 5158643 | The nv show evpn l3vxi --output json command returns an empty dictionary ({}). To work around this issue, run the nv show evpn l3vxi --rev=applied --output json command instead. | 5.18.0-5.18.1 | | -| 5146439 | When the BMC power restore policy is set to AlwaysOff, a BMC-only reboot causes the running switch host to be powered off even though no AC power loss occurs. To work around this issue, set the power restore policy to AlwaysOn or LastState. | 5.17.0-5.18.1 | | -| 5146376 | If the remote server is unreachable, rsyslog generates internal error messages that flood syslog. | 5.18.0-5.18.1 | | -| 5146099 | When operating at 100 percent line rate traffic runs from IXIA, the system experiences packet loss or latency in different traffic RFC tests. To work around this issue, configure the line rate at 99.9 percent and use ports from different IXIA Resource Groups. | 5.18.0-5.18.1 | | -| 5107338 | onie-install, onie-select, and cl-image-upgrade now allow only one instance of each to run at the same time, except for read (status check), which you can use at any time. | 5.18.0-5.18.1 | | -| 5089768 | When subscribing to gNMI paths that have multiple external paths for a single internal path, you see previous warning logs when there is no issue. | 5.16.5-5.18.1 | | -| 5080682 | The switchd port-security violation log prints RESTRICTed instead of Restricted. | 5.16.5-5.18.1 | | -| 5079383 | The BGP service might crash with an assertion failure in EVPN symmetric-IRB deployments that use VRF route leaking across multiple VRFs. The issue is caused by a missing reference count release on a BGP route destination node. Prolonged MAC mobility churn can trigger this condition. Large-scale deployments with many VRFs and EVPN multihoming are more susceptible. | 5.14.0-5.18.1 | | -| 5072739, 5089352 | Deleting more than 500 VRFs causes the nv config apply command to fail with the error Unable to reload-or-restart services (frr) / FRR configuration reload failed. | 5.17.0-5.18.1 | | -| 5002002 | When using an IPv6 VXLAN tunnel IP address, FRR treats the received type-3 EVPN route as a withdraw. | 5.16.1-5.18.1 | | -| 4993970 | Under certain conditions, AAA authentication restriction lockout attempts might not lock TACACS users out for failed REST API logins. | 5.17.0-5.18.1 | | -| 4992289 | After optimized image upgrade, the SSH service fails and NVUE shows an error Failed to translate the startup configuration, will continue with the original startup. | 5.16.1-5.16.4, 5.17.0-5.18.1 | 5.16.5| -| 4982910 | The mellanox platform driver fails to register a pm_power_off handler for legacy platforms. As a result, it falls through to ACPI power off which doesn't work correctly on the BIOS and causes a reset. | 5.17.0-5.18.1 | | -| 4891440 | The nv show interface qos-roce-status command causes HIGH CPU. | 5.16.0-5.18.1 | | -| 4875306 | You might see traffic drops on SLAAC and 802.1x interfaces. | 5.16.0-5.18.1 | | -| 4871161 | If you use NVUE commands to change the BGP autonomous system number (ASN) for existing VRFs without deleting the associated EVPN VNI, FRR reload fails and shows an error during nv config apply. Be sure to delete the layer 3 VNI before changing the BGP ASN or restart FRR after the AS change. | 5.9.1-5.18.1 | | -| 4841491 | When the Management-Privilege-Level or Cisco-Avpair is not found, a user is created with privilege level 0 instead of privilege level 1. | 5.16.0-5.18.1 | | -| 4774686, 4764590 | The final hop does not respond to traceroute with the layer 4 protocol set to TCP or UDP. | 5.16.0-5.18.1 | | -| 4667792 | Usernames longer than 32 characters do not authenticate against the switch. Avoid using long usernames. | 5.14.0-5.18.1 | | -| 4662854 | If you configure a DSCP match as ANY, the gNMI subscription does not show DSCP as ANY. The OpenConfig model supports only integer DSCP values. | 5.15.0-5.18.1 | | -| 4657192, 4414675 | On the NVIDIA SN5640 switch, after you configure a port as unsplit, links do not come up while optics are in use. To work around this issue, use copper cables. | 5.15.0-5.18.1 | | -| 4648833, 4662556, 4687350 | Interfaces using PAM4 DAC cables on switches with Spectrum-4 and later might not come up after a link flap or reboot if auto-negotiation is disabled. Auto-negotiation is required for PAM4 DAC cables on these switches. | 5.15.0-5.18.1 | | -| 4582679 | If a node has Suppress Route Advertisement enabled and routes are re-learned; for example, when a peer sends the route again due to route policy changes, or you enable or disable graceful shutdown, not all routes are offloaded, which might cause discrepancies in traffic. | 5.9.4-5.18.1 | | -| 4579237, 4579234 | If interface statistics telemetry is running on the switch, an interface_stats_collector core file might generate during statistics collection. | 5.11.3-5.11.5, 5.12.0-5.18.1 | | -| 4551249, 4572507, 4573399, 4712858, 4919013 | The NVUE service might fail during switch upgrade. To work around this issue, stop the sysmonitor with the sudo systemctl stop sysmonitor command, then upgrade the switch with the nv action upgrade system packages to latest command. | 5.14.0-5.18.1 | | -| 4549896 | When you try to set a VXLAN with a bridge, you see the error sx_sdk: 22985 [BRIDGE] [ERROR ]: Port(0x200A000D)) already added to a bridge. You can safely ignore this error. | 5.14.0-5.18.1 | | -| 4547463, 4705370 | When you run nv action boot-next commands during optimized image upgrade, the commands time out. This does not indicate that an issue occurred; the system might still be executing the action.
To check that the action command completed before going to the next step to reboot the system:
  1. Find the Request ID for the REST API invocation corresponding to the nv action boot-next command by doing a grep for ActionKey.*boot-next in the /var/log/nvued.log file. For example, the value 3 in the Ran Job running ActionKey('@boot-next', '/system/image', (), 3, (('partition', 'partition1'),)) line indicates the Request ID.
  2. Run the curl -u ':\' -X GET https://127.0.0.1:8765/nvue_v1/action/ -k command from the shell to show the status of the action command. If the value of state is action_success, the action command completed successfully. If the value of state is running, the system is still processing. If the value of state is action_error, the system encountered an error.
| 5.14.0-5.18.1 | | -| 4535806 | After a factory reset, the switch does not clear the /var/tmp directory, which the switch uses for temporary files. | 5.14.0-5.18.1 | | -| 4535699 | When you configure the RADIUS authentication order with local first and radius second, the RADIUS user is authenticated as a default user name. | 5.11.3-5.11.5, 5.12.1-5.18.1 | | -| 4534357 | During Cumulus Linux upgrade or downgrade, rsyslog might crash because the management (eth0) port is unavailable, which triggers a use-after-free fault and produces a cl-support file as a response. | 5.13.1-5.18.1 | | -| 4531960 | The GNMI Subscription to xpath interfaces/interface[name=swp61s0]/state/counters/out-pkts with a high sample interval results in an initial response of zero but in subsequent updates, the value is correct. You do not see this issue when the sample interval is 1 second. | 5.14.0-5.18.1 | | -| 4509255, 4546858 | In PTP two-step, the hardware incorrectly modifies the SYNC message correction field. | 5.12.0-5.18.1 | | -| 4508830 | Cumulus Linux allows you to add bond ports of mismatched speeds (such as 10G and 25G) to the same LACP bond without error and the bond reports UP. | 5.11.2-5.18.1 | | -| 4501632, 4530257 | NVIDIA recommends you wait for approximately 60 seconds after running nv config apply before power cycling the switch so that the NVUE database has time to sync to the filesystem. | 5.14.0-5.18.1 | | -| 4495383, 4493988 | NVUE configuration yaml file translation converts unset commands to set commands because the translation logic expects only set commands. | 5.13.0-5.18.1 | | -| 4495231 | If the hardware clock date is later than 2038-01-19 03:14:07 UTC, the image might fail to install due to a grub-install failure on the EFI filesystem, which is a VFAT filesystem. As a result, you see the grub prompt immediately after reboot. To work around this issue, reboot from the grub prompt to go into ONIE. From ONIE, use the date command to set a date before 2038-01-19, then run the hwclock --systohc command to add it to the hardware clock. You can then use onie-nos-install to install the image. | 5.9.0-5.18.1 | | -| 4475401 | External input such as Ctrl+\ might trigger core dumps on the serial console from /bin/login. This behavior is caused by external sources, such as console servers or automation tools, and does not reflect a fault in the operating system. As a potential result, the serial console might become unresponsive. | 5.14.0-5.18.1 | | -| 4475074 | The SN5610 switch records a High FEC Bin Error at room temperature. | 5.13.0-5.18.1 | 5.11.2| -| 4440766 | When you try to delete a trusted ca key, Cumulus Linux shows an incorrect error message. To remove a trusted ca key, you must unset the key ID, not the key literal. | 5.13.0-5.18.1 | | -| 4423248 | If you unset an interface static IP address when the interface IP gateway is configured, the nv config apply command fails with an ifreload.service error. To work around this issue, unset both the static IP address and gateway together. | 5.9.0-5.18.1 | | -| 4423244 | When you enable, then disable adaptive routing, the BGP neighbors might go down because of an unresolved MAC address. To work around this issue, configure another attribute on the interface. | 5.9.0-5.18.1 | | -| 4423175 | When you configure an API port with a TCP port already in use, the nginx server fails to restart. | 5.13.0-5.18.1 | 5.11.2| -| 4413589 | A MAC-only EVPN type-2 route is wrongly advertised with the layer 3 VNI label in the BGP NLRI (Network Layer Reachability Information). Although this does not have any functional impact, it is not the desired RFC behavior. | 5.13.0-5.18.1 | | -| 4337278 | Statically configured VXLAN entries sometimes age out after a peer link flap. | 5.12.0-5.18.1 | | -| 4329931 | Cumulus Linux incorrectly allows SyncE and PPS to be enabled at the same time. Upgrading systems with both features configured using NVUE to 5.12.0 or later results in a failure to apply the startup configuration as part of the first boot of the upgraded version. To work around the issue, unset one of the features before you upgrade. | 5.12.0-5.18.1 | | -| 4309876 | When you configure an invalid switch port (swp), NVUE adds the invalid configuration instead of rejecting it. The invalid interface in the configuration does not have any functional impact. | 5.12.0-5.18.1 | | -| 4308857 | When you use tls_crlcheck in the /etc/nslcd.conf file, the optional nslcd service fails due to a missing library. | 5.9.2-5.9.3, 5.12.0-5.18.1 | 5.9.4| -| 4294156 | After you clear the RoCE counters with the nv action clear interface qos roce counters command, the buffer-max-usage counters in the nv show interface qos roce counters command output do not show updated (cleared) values. | 5.12.0-5.18.1 | | -| 4277042 | On the NVIDIA SN5600 switch, you see low power alarms immediately after a reboot. The alarms disappear after showing up initially. Certain modules typically show low power alarms on initialization. No action is needed. | 5.12.0-5.18.1 | | -| 4249096 | Binary upgrade from Cumulus Linux 4.3.1 to 5.12.0 and later is not supported. To work around this issue, perform a binary upgrade from Cumulus Linux 4.3.1 to 5.9.0, then perform a binary upgrade from Cumulus Linux 5.9.0 to 5.12.0 or later. | 5.12.0-5.18.1 | | -| 4236419 | On the Spectrum-3 switch, the PTP offset for 25GbE fluctuates within a range of plus or minus 50 nanoseconds beyond the expected values. | 5.12.0-5.18.1 | | -| 4214678 | Changes to open telemetry configuration or export states restarts the telemetry service and resets all health metrics. | 5.12.0-5.18.1 | | -| 4177067 | When performing a package upgrade, nslcd installation might open an interactive dialog to configure nslcd.conf.
To avoid this interactive dialog, set the DEBIAN_FRONTEND environment variable to noninteractive. For example:
cumulus@switch:~$ sudo apt-get update
cumulus@switch:~$ sudo DEBIAN_FRONTEND=noninteractive apt-get -y -o "Dpkg::Options::=--force-confdef" -o "Dpkg::Options::=--force-confold" upgrade
| 5.11.0-5.18.1 | | -| 4154839, 4280933, 4291934 | When you run certain SDK commands (such as sudo sx_api_port_counter_dump_all.py or sx_api_fdb_dump) first as the cumulus user, then with sudo, you see the following error:
PermissionError: Errno 13] Permission denied: '/tmp/python_err_log.txt'

To resolve this issue, run the rm -rf /tmp/python_err_log.txt command. | 5.11.0-5.18.1 | | -| 4142857 | The switch drops PTP packets received with extra ethernet padding and you see syslog [ptp4l.ERR] messages. | 5.10.0-5.18.1 | | -| 4139511, 4184813, 4180112 | When you generate the cl-support file on the Spectrum-4 switch, the following messages appear on the serial console. You can safely ignore this issue.
[ 1903.595131] mlxsw_minimal 2-0048: Could not acquire lock
[ 1903.601089] mlxsw_minimal 2-0048: Reg cmd access failed (reg_id=900a(mtmp),type=query)
[ 1903.609961] hwmon hwmon28: Failed to query module temperature thresholds
[ 1903.846724] mlxsw_minimal 2-0048: Could not acquire lock
[ 1903.852689] mlxsw_minimal 2-0048: Reg cmd access failed (reg_id=900a(mtmp),type=query)
[ 1903.861573] hwmon hwmon28: Failed to query module temperature
| 5.11.0-5.18.1 | | -| 4134447 | The journal logs might include the error message ERR kernel: [ 7.453789] usb usb2-port2: connect-debounce failed. You can safely ignore this log message. | 5.11.0-5.18.1 | | -| 4129757 | If you include a comma in the BGP community list, extended community list, or large community list regex expression of a routing policy, you see error messages and FRR reload fails. Make sure the regex expression does not contain a comma.
For example, instead of ^65550:([0-9]{1,2}\|[1-9][1-9]):.*$, specify ^65550:([0-9]\|[0-9][0-9]):.*$ and instead of ^65550:([0-4]{1,2}\|[7-9][8-9]):.*$, specify ^65550:([0-4]\|[0-4][0-4]\|[7-9][8-9]):.*$. | 5.11.0-5.18.1 | | -| 4124376, 4316163 | The SN3700C-S, SN5400, and SN5600 secure boot switch running Cumulus Linux 5.11.0 or later boots with shim 15.8 that adds entries to the SBAT revocations to prevent the switch from booting shim 15.7 or earlier (included in Cumulus Linux 5.10 and earlier).
To downgrade a secure boot switch from Cumulus Linux 5.11.0 or later, or to recover a downgraded switch that does not boot, follow the steps in Downgrade a Secure Boot Switch. | 5.11.0-5.18.1 | | -| 4118970 | When running PTP, the performance for 100Gx2 and 400Gx8 can have a high offset in up to 1.5% of the sampling. | 5.11.0-5.18.1 | | -| 4105127, 4796391 | Any sFlow configuration changes that require an hsflowd restart are operational only after an initial delay of 60 seconds. | 5.11.0-5.18.1 | | -| 4100629 | NVUE show command outputs show LLDP neighbor changes only after the LLDP update frequency multiplied by the hold time. | 5.11.0-5.18.1 | | -| 4082210 | When you change the CPU resource limit with the nv set service control rsyslog resource-limit cpu command, the rsyslog agent does not start. To work around this issue, increase the CPU resource limit, then restart the service manually. | 5.11.0-5.18.1 | | -| 4077921 | You cannot use package upgrade to upgrade from Cumulus Linux 5.9.2 to Cumulus Linux 5.10.1 or later. You must install the Cumulus Linux image instead. | 5.10.1-5.18.1 | | -| 4049213, 4186873 | When there are routes that point to a single next hop, an ECMP entry is created in the SDK. After the single next hop from the route is removed, the ECMP entry might stay in the SDK until the time the next hop is present in the kernel. | 5.9.2-5.18.1 | | -| 4047798 | Packet distribution based on ECMP hashing using GTP-TEID does not function as expected in an EVPN Clos topology. | 5.10.0-5.18.1 | | -| 4030380 | When you roll back interface configuration to the default setting with the nv unset interface command, NVUE removes the complete entry for the interface from the /etc/network/interface file, and puts the interface in admin down. As a result, you cannot configure FEC on the interface at the lower layers. | 5.10.0-5.18.1 | | -| 4005422, 4007590, 4015452 | When you upgrade Cumulus Linux 5.9.1 to Cumulus Linux 5.10 or later with package upgrade, the NTP service stops. To restart the NTP service, enable, then restart the service in the VRF in which it was running with the systemctl enable ntpsec@ and systemctl restart ntpsec@ commands. | 5.10.0-5.18.1 | | -| 3985682 | On Spectrum-4 switches, multicast flows containing packets smaller than 512 bytes might not reach full line rate. Cumulus Linux supports 512 byte and larger multicast packets. | 5.10.0-5.18.1 | | -| 3966312 | When connecting the SN5xxx switch to third party test equipment (such as IXIA) using copper cables at 100GbE, 200GbE, 400GbE, or 800GbE, links do not come up. | 5.10.0-5.18.1 | | -| 3948068 | On the SN3700 and SN3700c switch, the nv show platform environment voltage command output shows a failed state for the PSU-n-12V-RAIL-OUT sensors. This is a known hardware limitation that cannot be corrected by the PSU vendor. | 5.10.0-5.18.1 | | -| 3915878 | If you configure remote syslog export through a non-default VRF, you might see repeated error logs from the rsyslog process while the switch is booting:
rsyslogd: create UDP socket bound to device failed: No such device [v8.2302.0]rsyslogd: No UDP socket could successfully be initialized, some functionality may be disabled.  [v8.2302.0]

The logs occur because the rsyslog service starts before the networking service creates the configured VRF for syslog export. There is no functional impact with this issue. | 5.9.0-5.18.1 | | -| 3879717 | Running snmpwalk on the switch with the management IP address does not work. To work around this issue, use the localhost option (snmpwalk -v 2c -c public28 localhost 1.3.6.1.2.1.14) or create a control plane ACL whitelist rule. | 5.10.0-5.18.1 | | -| 3878394 | When ZTP runs a script that contains wget, ZTP fails and you see a message similar to the following:
ZTP: ZTP DHCP: Unexpected error: 'ascii' codec can't decode byte 0xe2 in position 181: ordinal not in range(128)ZTP: Script returned failure

To work around this issue, use the -q option with wget. | 5.9.0-5.18.1 | | -| 3877516 | When you connect two NVIDIA switches and configure 400G speed in force mode, links don't come up.
To work around this issue, make sure auto-negotiation is always on when connecting NVIDIA to NVIDIA in PAM4. | 5.9.0-5.18.1 | | -| 3875373 | When you run the nv config apply empty command, NVUE removes the cumulus user. If you are logged in as the cumulus user when you run the nv config apply empty command, the command fails. | 5.9.0-5.18.1 | | -| 3861745 | On UEFI hardware (where the /sys/firmware/efi directory exists), using the update-grub program might generate a /boot/grub/grub.cfg that is incorrect for booting ONIE if the ONIE option is selected on the console while booting. To work around this issue, run mount LABEL="EFI System" /boot/efi before using update-grub. | 5.9.0-5.18.1 | | -| 3855796 | When configuring a Unicast Master Table for clients, the server addresses must be reachable and the route to the destination must exist. The unicast table can have one directly-connected port for a client. This restriction is only for directly connected ports and doesn't apply to Unicast Servers on other devices or switches. | 5.9.0-5.18.1 | | -| 3847439 | In rare cases on the Spectrum 1 switch, where a dual connected host transmits all traffic flows to only one switch in a connected MLAG pair, and the host changes behavior to hash all flows to the other MLAG switch, there might be traffic loss if the MAC FDB entry on the original switch ages out. | 5.9.0-5.18.1 | | -| 3819945 | When you connect an NVIDIA SN4410, SN4700, or SN5600 switch to any Spectrum 1, Spectrum-2, or Spectrum-3 peer switch (with four lanes) using a 4x breakout configuration and the default lanes per port setting, links do not come up. To work around this issue, provide the lanes per port configuration shown below:
cumulus@switch:~$ nv set interface  link breakout 4x lanes-per-port 1
| 5.9.0-5.18.1 | | -| 3818545 | The terminal monitoring software SecureCRT has a known issue when running on both Windows and Mac systems where it gets stuck when monitoring the serial port of the switch as Cumulus Linux boots up. When this occurs, the serial port stops as shown below and SecureCRT is unable to receive any more serial data from the switch (it is able to transmit).
Mounting dev-hugepages.mount - Huge Pages File System..
Mounting dev-mqueue.mount
| 5.9.0-5.18.1 | | -| 3774274 | When you manually configure the /etc/cumulus/datapath/qos/qos_features.conf file without applying the QoS configuration with NVUE, running the nv config apply empty command later does not clean up the QoS configuration. If the QoS configuration includes breakout ports, the nv config apply empty command fails due to a switchd reload trigger failure. To work around this issue, clean up the configuration manually in the /etc/cumulus/datapath/qos/qos_features.conf, then run the nv config apply empty command. | 5.8.0-5.18.1 | | -| 3773177 | When you try to upgrade a switch from Cumulus Linux before 5.6.0 with package upgrade, you might see errors for expired GPG keys that prevent you from upgrading. To work around this issue, install the new keys with the following commands, then upgrade the switch.
cumulus@switch:~$ wget https://download.nvidia.com/cumulus/apt.cumulusnetworks.com/repo/pool/cumulus/c/cumulus-archive-keyring/cumulus-archive-keyring_4-cl5.6.0u5_all.deb
cumulus@switch:~$ sudo apt install ./cumulus-archive-keyring_4-cl5.6.0u5_all.deb
cumulus@switch:~$ sudo apt update
cumulus@switch:~$ sudo apt upgrade
| 4.0.0-4.4.5, 5.0.0-5.18.1 | | -| 3771168 | When you perform an ISSU upgrade on a Spectrum 1 switch, the switchd service might crash. | 5.8.0-5.18.1 | | -| 3677533 | Due to resource constraints on the Spectrum 1 switch, staticd performance drops and takes longer to read static routes compared to the time BGP takes to complete a graceful restart and advertise routes and EOR to its helpers. As a result, static routes are advertised after the EOR is sent to graceful restart helpers, which delete the stale static routes and relearn them after receiving the EOR from the restarting node. Temporary traffic loss might occur. | 5.7.0-5.18.1 | | -| 3655681 | When you disable, then enable STP auto-edge on a port, the port might not transition to the operational edge even though the port does not receive BPDUs. To work around this issue, configure the port as an admin-edge port. | 5.7.0-5.18.1 | | -| 3637444 | Applying an inbound control plane ACL on the eth0 management interface does not take effect. To work around this issue, apply the ACL on the mgmt interface; for example, nv set interface mgmt acl inbound control-plane. | 5.7.0-5.18.1 | | -| 3591918 | The nv action disconnect system aaa user command does not clear all open sessions. To work around this issue, run the command as many times as the number of sessions. | 5.6.0-5.18.1 | | -| 3587393 | If you use the NVIDIA SN5600 (Spectrum-4) switch with Ixia test equipment, you might experience delayed link up due to intermittent link flaps.
To work around this issue when using copper cables:
To work around this issue when using fiber cables:
| 5.6.0-5.18.1 | | -| 3556762, 3463827 | On rare occasions, SPT switchover might not happen cleanly in PIM resulting in some dropped packets. If you use PIM-SM to replicate EVPN BUM traffic, you might see a brief drop of multicast traffic before recovering due to normal PIM-SM traffic timeout. | 5.5.0-5.18.1 | | -| 3540510 | 400Gx8 ports only support traffic line rate with packets that are larger than 172 bytes. | 5.6.0-5.18.1 | | -| 3538321, 3564344 | In rare cases, an STP topology change on PTP over a VLAN can result in the switch losing the slave state and one of the ports might remain in an uncalibrated state. To work around this issue, toggle the port that is in the uncalibrated state up and down so that one of the ports is selected as the slave. | 5.6.0-5.18.1 | | -| 3497622 | When you remove PSUs, then plug them back in, you might experience traffic loss and some ports might be in a down state. | 5.6.0-5.18.1 | | -| 3472163 | On a switch with the Spectrum-4 ASIC, packets that are smaller than 256 bytes are not included in multicast flows. Multicast flows support packets that are 256 bytes or larger. | 5.6.0-5.18.1 | | -| 3444490 | Migration from ONYX to Cumulus Linux is supported and tested with ONYX version 3.10.4302 GA only. | 5.6.0-5.18.1 | | -| 3442569, 3520880, 3586421 | When trying to access the NVUE API, user accounts authenticated with a newly-configured external service, such as TACACS, RADIUS, or LDAP, receive a 401 forbidden error. To work around this issue, after enabling a new authentication service, make sure to restart both nginx.service and nvued.service to begin authenticating users against the new authentication service. | 5.5.0-5.18.1 | | -| 3430430, 3337848 | When you configure PTP on 50G ports, the offset correction might be higher, which can affect the time synchronization of the node. To work around this issue, configure PTP on 100G ports, or on 10G or 1G ports with PTP shaper enabled. | 5.5.0-5.18.1 | | -| 3424967, 3413785 | sudo for TACACS+ users with privilege level 15 does not work when reaching the TACACS+ server through the default VRF. To work around this issue, specify the interface name that the default VRF uses in the vrf= setting of the /etc/tacplus_servers file or run the NVUE nv set system aaa tacacs vrf command. If you don't run either command, a TACACS+ user with privilege level 15 can run vrf task exec default sudo ... to execute the sudo command. | 5.0.0-5.18.1 | | -| 3420056 | The ADVA 5401 SFP module with hardware revision 5.01 does not come up at layer 1 when you use 10G QSA adaptors. To work around this issue, use 25G QSA adaptors. | 4.4.0-4.4.5, 5.0.0-5.18.1 | | -| 3414866, 3536555, 4465009, 4509253, 4732973 | Each VLAN is represented as a bitmap on the underlying port and when you add multiple VLANs together, Cumulus Linux iterates over the existing ones and updates the diff. However, in few corner cases, the same bitmap might be repeated again causing the following error.
sx_sdk: 22985 [BRIDGE] [ERROR  ]: Port(0x200A000D)) already added to a bridge

You can ignore this error; it has no impact on switch functionality. | 5.6.0-5.18.1 | | -| 3362113 | If you restore an NVUE startup.yaml file or run the nv config patch command after an upgrade that includes breakout ports with QoS configuration, the NVUE configuration fails to apply. Subsequent attempts to run nv config apply fail with a message similar to Invalid config [rev_id: 11] qos config is not supported on the following invalid interface: swp1s0. Supported on swp and bond interface types. To work around this issue, run nv unset on the configured QoS settings, then apply the breakout port configuration before you configure QoS. Alternatively, you can remove the QoS configuration from the yaml file and patch it separately after applying the breakout configuration. | 5.4.0-5.18.1 | | -| 3347538 | When connecting NVIDIA-to-NVIDIA in PAM4, you must enable auto-negotiation. | 5.4.0-5.18.1 | | -| 3341214 | If you use the NVUE REST API to configure a local user with a hashed password, the user cannot log in and the /etc/nvue.d/startup.yaml file shows the password as plain text. | 5.4.0-5.18.1 | | -| 3329518 | When using TACACS+, if the /etc/nsswitch.conf file specifies passwd: files tacplus (files is listed before tacplus), a user that is present in both the local /etc/passwd file and the TACACS+ server cannot log into the switch. NVIDIA recommends that when using TACACS+, you list tacplus before files in /etc/nsswitch.conf. When using NVUE, ensure that tacacs has priority over local. | 5.4.0-5.18.1 | | -| 3327477 | If you use su to change to a user specified through TACACS+, the user becomes the local tacacs0 thru tacacs15 user instead of the named user to run sudo commands. As a result, the named user password might not match the local tacacs0 thru tacacs15 user password. | 3.7.0-3.7.16, 4.0.0-4.4.5, 5.0.0-5.18.1 | | -| 3326659 | If you have a large number of MAC addresses, they do not age out at the MAC ageing timeout value configured on the switch. It might take up to 30 seconds more for the MAC addresses to age out and be deleted from the hardware. To work around this issue, wait for the ageing timeout value plus 30 seconds. | 5.4.0-5.18.1 | | -| 3253218 | Auto-negotiation isn't supported on Spectrum-2 and Spectrum-3 switches using the 1G SFP-T module; FORCE 1G is configured instead. | 5.4.0-5.18.1 | | -| 3241567 | When you apply switch configuration for the first time on a freshly booted switch and you run the nv config apply command after setting the hostname with nv set system hostname, you might see the error message Failed to start Hostname Service. To work around this issue, run the nv config apply command a second time. | 5.3.0-5.18.1 | | -| 3226506 | The l1-show eth0 command does not show port information and is not supported in this release. | 5.3.0-5.18.1 | | -| 3225117, 3158720 | Occasionally, packet loss might occur on 25G ports when the link is raised without FEC. | 5.4.0-5.18.1 | | -| 3172504 | When you connect the NVIDIA SN4600C switch to a Spectrum 1 or Spectrum-3 switch with a 40GbE passive copper cable (Part Number: MC2210126-005) on edge ports 1-4 and 61-64, there is an Effective BER of 1E-12 in PHY. | 5.2.0-5.18.1 | | -| 3147782 | You cannot use NVUE to configure an SNMP view to include a subtree beginning with a period. For example:
cumulus@switch:~$ nv set service snmp-server viewname cumulusOnly included .1.3.6.1.4.1.40310Error: GET /nvue_v1/service/snmp-server/viewname/cumulusOnly/included?pointers=%5B%22%2Fparameters%22%2C+%22%2Fpatch%2FrequestBody%2Fcontent%2Fapplication~1json%2Fschema%22%2C+%22%2Fpatch%2Fparameters%22%2C+%22%2Fpatch%2Fresponses%2F200%2Flinks%22%5D responded with 404 NOT FOUND
To work around this issue, reference the OID without the preceding period ( . ) in the command. | 5.3.0-5.18.1 | | -| 3145869, 3430508, 3543102 | On a Spectrum-3 switch, the PTP offset in 10GbE changes between plus or minus 27. The average offset is around 7. | 5.2.0-5.18.1 | | -| 3135952 | PAM4 split cables (such as 2x100G, 4x100G, and 4x50G) do not work with a forced speed setting (when auto-negotiation is off) as the default speed enabled is for NRZ mode (such as 100G_4X). To work around this issue, set the appropriate lanes for forced speed (with auto-negotation off) with the ethtool -s swpX speed autoneg off lanes command. For example: 
cumulus@switch:~$ sudo ethtool -s swp1 speed 100000 autoneg off lanes 2
| 5.2.0-5.18.1 | | -| 3115242 | When you configure two VNIs in the same VLAN, ifupdown2 shows a vlan added to two or more VXLANS warning, which is only issued after the VNI is already added to the bridge. This leaves the new VNI in the PVID even if there is already an existing VNI configured in that PVID. | 5.1.0-5.18.1 | | -| 3103821 | On the NVIDIA SN4700 switch, inserting and removing the PSU might cause loss of frames. | 5.2.0-5.18.1 | | -| 3084476 | After you disable traffic shaping in the /etc/cumulus/datapath/qos/qos_features.conf file, the default QOS traffic shaping configuration does not restore. To work around this issue, restart switchd. | 4.4.3, 5.0.0-5.18.1 | 4.4.4-4.4.5| -| 3084027 | Under a high load, you might see ingress drop counters increase. The drops are classified as HwIfInDiscards in ethtool and shown as ingress_general in hardware. | 4.3.0-4.4.5, 5.0.0-5.18.1 | | -| 3071652 | On rare occasions, after you reboot or restart switchd on a Spectrum 1 switch, any 25G connections with Direct Attach Copper (DAC) cables that connect from the switch to a non-NVIDIA device might flap continuously. To work around this issue, bring the affected link administratively down for a few seconds on the non-NVIDIA device, then bring the link back up. | 4.4.4-4.4.5, 5.1.0-5.18.1 | | -| 3061656 | When the CPU load is high during a warm boot, bonds with a slow LACP rate fail to forward layer 2 traffic for up to 60 seconds (depending on the duration of the CPU load) and static bonds fail to forward layer 2 traffic for up to 5 seconds. | 5.1.0-5.18.1 | | -| 2972538, 2972540 | With RADIUS enabled for user shell authentication, there might be a delay in local user authentication for non cumulus user accounts. | 3.7.15-3.7.16, 5.0.0-5.18.1 | | -| 2951110 | The net show time ntp servers command does not show any output with the management VRF. | 3.7.15-3.7.16, 4.1.1-4.4.5, 5.0.0-5.18.1 | | -| 2904450, 2553222 | When you run the ethtool -m or the l1-show command, the 400G interface optical values do not show. | 4.4.0-4.4.5, 5.0.0-5.18.1 | | -| 2885305, 2887500, 3234087, 3074929, 3293192 | Certain Murata PSU attributes show intermittently in the sensors command output. To work around this issue, upgrade to the latest PSU firmware on Murata. | 5.0.0-5.18.1 | | -| 2867042 | When connecting the NVIDIA SN4600 switch to another NVIDIA Spectrum switch, you must use auto-negotiation mode (not force mode); otherwise the switch might use the wrong Tx configuration. | 5.0.0-5.18.1 | | -| 2823307 | Cumuls Linux does not support a bond with more than 64 ports. Any configuration with more than 64 ports in a bond changes all ports to down when you apply the configuration. | 5.0.0-5.18.1 | | -| 2736108 | When you change the VRRP advertisement interval on the master, the master advertisement interval field in the show vrrp command output does not show the updated value. | 4.4.0-4.4.5, 5.0.0-5.18.1 | | -| 2684925 | The NVUE nv show vrf default router bgp peer command produces a 404 not found error. | 4.4.0-4.4.5, 5.0.0-5.18.1 | | -| 2671652 | In VXLAN routing environments, you might experience sub-optimal route convergence delays (longer than five seconds) when a prefix transitions to a new ECMP next-hop group. This condition might occur when a VTEP loses ECMP routes through all uplink peerings, then installs the routes through a different path, such as an MLAG peerlink. | 4.4.0-4.4.5, 5.5.0-5.18.1 | | - -### Fixed Issues in 5.18.1 -| Issue ID | Description | Affects | -|--- |--- |--- | -| 5231079 | BGP does not update an already-established BFD session when it later resolves the peer through a different interface. Affected BFD sessions are left bound to the wrong interface and never come up. | 5.18.0 | | -| 5225676, 5217147 | When you perform a factory reset after an optimized image upgrade, the switch loses record of its model information. | 5.16.6-5.18.0 | | -| 5225576 | After an optimized image upgrade from Cumulus Linux 5.13.1 or earlier to a later release, the install step fails with a permission error if the image being installed is already present in the /var/images directory before the upgrade. In this state, the nv show system image files command might not list any images. To work around this issue, fetch the image with the nv action fetch system image command before installing it. Alternatively, correct the directory permissions with sudo chmod 0755 /var/images. | 5.16.6-5.18.0 | | -| 5221596, 5215402, 5200160 | During an optimized image upgrade, the configuration restore step copies the files in /etc/hw-management-thermal/ from the previous release onto the new partition. These files do not contain the settings that Cumulus Linux requires to select the current thermal control algorithm, so the switch runs the previous algorithm instead. That algorithm does not apply the transceiver temperature setpoint or the module temperature cap, so the fan curve follows the transceivers' own factory temperature limits instead of the configured values. | 5.16.6 | | -| 5221595 | In certain cases, the switch does not forward traffic on some interfaces in an ECMP group. To work around this issue, flap the affected interface. | 5.18.0 | | -| 5221594, 5217093, 5175518 | The switchd watchdog crashes due to a netlink buffer overflow triggered by continuous next hop group churn. | 5.16.1-5.16.6, 5.18.0 | | -| 5221593, 5217097, 5179671, 5221604 | After optimized image upgrade, /run/tmpfs, which holds the upgraded partition, runs out of space. As a result, the switch does not migrate all the certificates to the new partition. This issue prevents NVUE from installing the user defined certificates defaulting to a self signed certificate. | 5.16.5-5.16.6 | | -| 5221592, 5217101 | AR ECMP updates during route deletion might result in ECMP database corruption and ECMP operation failures resulting in the following log messages:
switchd[23072]: hal_mlx_sdk_nexthop_wrap.c:789 ERR ECMP: AR cmd CREATE failed: Entry Already Exists, nexthops 18
switchd[23072]: hal_mlx_sdk_nexthop_wrap.c:934 ERR ECMP: failed to CREATE adaptive ecmp in hw
switchd[23072]: hal_mlx_ecmp.c:2426 ERR ECMP: error allocating AR ecmp
switchd[23072]: hal_mlx_sdk_nexthop_wrap.c:707 ERR ECMP: Failed to set adaptive container attributes for ecmp
| 5.16.5-5.16.6 | | -| 5221591, 5217107, 5183514 | The NVUE set command returns a traceback in the output when the per user repo_incarnation file (/home/$USER/.local/share/nvue/repo_incarnation) is non-writable. | 5.16.1-5.16.6 | | -| 5221590, 5217108, 5182789, 5216045, 5215790 | BGP peer sessions might repeatedly flap and re-establish. During outbound TCP connect, the BGP service might clear the local nexthop information for the peer and fail nexthop setup when the remote endpoint is not yet available, which resets the session. Logs might show nexthop_set failed with remote: (null) and Transport endpoint is not.... | 5.16.1-5.16.6 | | -| 5221589, 5221130 | When multiple gNMI bulk counter sessions are requested frequently, gNMI metric export might fail. | 5.16.5-5.16.6 | | -| 5221588, 5221379 | In rare scenarios, a link fault recovery sequence might trigger a switchd watchdog timeout on Spectrum-4 switches. | 5.16.3-5.16.6 | | - ## 5.18.0 Release Notes ### Open Issues in 5.18.0