Added validation check for CSCwt58626 by muthu-ku · Pull Request #405 · datacenter/ACI-Pre-Upgrade-Validation-Script

muthu-ku · 2026-07-02T12:09:27Z

Added new validation for the defect CSCwt58626.

This check will check if the InfraVLAN overlaps with any user-configured VLAN pool range in Access Policies.

Apic failure logs:

  python aci-preupgrade-validation-script.py --tversion "6.1(3g)" -d "infravlan_overlap_access_policy_check"
    ==== 2026-07-09T08-26-08+0000, Script Version v4.2.0-dev  ====

!!!! Check https://github.com/datacenter/ACI-Pre-Upgrade-Validation-Script for Latest Release !!!!

To use a non-default Login Domain, enter apic#DOMAIN\\USERNAME
Enter username for APIC login          : admin
Enter password for corresponding User  :

Gathering Node Information...

Current APIC Version...6.2(2e)
Lowest Switch Version...4.2(3j)

Target APIC version is overridden to 6.1(3g)

Collecting VPC Node IDs...

Progress: |----------------------------------------------------------------------------------------------------| 0/1 checks Progress: |----------------------------------------------------------------------------------------------------| 0/1 checks Progress: |----------------------------------------------------------------------------------------------------| 0/1 checks Progress: |----------------------------------------------------------------------------------------------------| 0/1 checks Progress: |----------------------------------------------------------------------------------------------------| 0/1 checks Progress: |----------------------------------------------------------------------------------------------------| 0/1 checks Progress: |----------------------------------------------------------------------------------------------------| 0/1 checks Progress: |----------------------------------------------------------------------------------------------------| 0/1 checks Progress: |----------------------------------------------------------------------------------------------------| 0/1 checks Progress: |----------------------------------------------------------------------------------------------------| 0/1 checks Progress: |----------------------------------------------------------------------------------------------------| 0/1 checks Progress: |----------------------------------------------------------------------------------------------------| 0/1 checks Progress: |----------------------------------------------------------------------------------------------------| 0/1 checks Progress: |----------------------------------------------------------------------------------------------------| 0/1 checks Progress: |----------------------------------------------------------------------------------------------------| 0/1 checks Progress: |----------------------------------------------------------------------------------------------------| 0/1 checks Progress: |----------------------------------------------------------------------------------------------------| 0/1 checks Progress: |----------------------------------------------------------------------------------------------------| 0/1 checks Progress: |----------------------------------------------------------------------------------------------------| 0/1 checks Progress: |----------------------------------------------------------------------------------------------------| 0/1 checks Progress: |----------------------------------------------------------------------------------------------------| 0/1 checks Progress: |----------------------------------------------------------------------------------------------------| 0/1 checks Progress: |----------------------------------------------------------------------------------------------------| 0/1 checks Progress: |████████████████████████████████████████████████████████████████████████████████████████████████████| 1/1 checks completed


=== Check Result (failed only) ===

[Check 1/1] InfraVLAN Overlap in Access Policy VLAN Pools...                                                      FAIL - UPGRADE FAILURE!!
  InfraVLAN  VLAN Pool             Encap Block
  ---------  ---------             -----------
  4093       test_infra_vlan_pool  vlan-4030 to vlan-4094

  Recommended Action: Remove InfraVLAN from VLAN pool block highligted or upgrade to fix version
  Reference Document: https://datacenter.github.io/ACI-Pre-Upgrade-Validation-Script/validations/#infravlan-overlap-access-policy-check



=== Summary Result ===

PASS                        :  0
FAIL - OUTAGE WARNING!!     :  0
FAIL - UPGRADE FAILURE!!    :  1
MANUAL CHECK REQUIRED       :  0
POST UPGRADE CHECK REQUIRED :  0
N/A                         :  0
ERROR !!                    :  0
TOTAL                       :  1

    Pre-Upgrade Check Complete.
    Next Steps: Address all checks flagged as FAIL, ERROR or MANUAL CHECK REQUIRED

    Result output and debug info saved to below bundle for later reference.
    Attach this bundle to Cisco TAC SRs opened to address the flagged checks.

      Result Bundle: /data/techsupport/muthu/preupgrade_validator_2026-07-09T08-26-08+0000.tgz

==== Script Version v4.2.0-dev FIN ====

apic_failure_log.txt
apic_full_run_log.txt
pytest_full_run_log.txt
pytest_log.txt

lovkeshsharma702

all intigrated test passed.

monrog2 · 2026-07-07T20:36:03Z

+
+Due to [CSCwt58626][77], when targeting APIC version 6.1(3f) to 6.1(5e) or 6.2(1g) , if the InfraVLAN overlaps with any user-configured VLAN pool range in Access Policies, fault `F4701` is raised for VLAN pools that include the InfraVLAN. After the upgrade, domains linked to those VLAN pools cannot be associated with new EPGs, although existing EPGs continue to function.
+
+To avoid this issue, modify user VLAN pool ranges so that the InfraVLAN does not overlap with any configured block or select target version with fix.


@lovkeshsharma702 include some detail about the planned fix, otherwise this checks details will have to be updated again after release.

@lovkeshsharma702 include some detail about the planned fix, otherwise this checks details will have to be updated again after release.

@monrog2 this was a regression in 6.1(3f) to 6.1(5e) or 6.2(1g). fixed above 615 and 6.2.x. only 6.2.2eis release so far, hence fix version for 615 not mentioned in the bug. @muthu-ku please add 6.2.2e as fixed version in bug.

Main point of this one is to call out the behavior change implemented in the fixed versions.

my understanding is:
PD will block path binding on user tenant if the binding it pushing the infra VLAN.

HOWEVER, Infra tenant can do this without issue.

affected version behavior relies solely on access policy lookup, which means whether infra or user tenant, any extension of infra VLAN causes the fault + blocking condition seen today.

point for clarification is how this would affected vmm bindings for infra vlan within user tenant, such as k8 integration

Added validation check for CSCwt58626

8f68a28

lovkeshsharma702 suggested changes Jul 2, 2026

View reviewed changes

muthu-ku added 4 commits July 3, 2026 06:28

updated comments

8f858b8

resolved merge conflict

cd8d121

updated merge conflict

1dad1ef

updated missing import for stale_dbgacEpgSummaryTask_check

bb531b5

lovkeshsharma702 approved these changes Jul 3, 2026

View reviewed changes

monrog2 requested changes Jul 7, 2026

View reviewed changes

muthu-ku added 3 commits July 8, 2026 12:15

updated the review comments

5afb200

updated pytest case

8c4e053

changed result for failure and error case

3c90277

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Added validation check for CSCwt58626#405

Added validation check for CSCwt58626#405
muthu-ku wants to merge 8 commits into
datacenter:v4.2.0-devfrom
muthu-ku:CSCwt58626

muthu-ku commented Jul 2, 2026 •

edited

Loading

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

lovkeshsharma702 left a comment

Uh oh!

monrog2 Jul 7, 2026

Uh oh!

lovkeshsharma702 Jul 8, 2026

Uh oh!

monrog2 Jul 8, 2026

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants


		Due to [CSCwt58626][77], when targeting APIC version 6.1(3f) to 6.1(5e) or 6.2(1g) , if the InfraVLAN overlaps with any user-configured VLAN pool range in Access Policies, fault `F4701` is raised for VLAN pools that include the InfraVLAN. After the upgrade, domains linked to those VLAN pools cannot be associated with new EPGs, although existing EPGs continue to function.

		To avoid this issue, modify user VLAN pool ranges so that the InfraVLAN does not overlap with any configured block or select target version with fix.

Uh oh!

Conversation

muthu-ku commented Jul 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

lovkeshsharma702 left a comment

Choose a reason for hiding this comment

Uh oh!

monrog2 Jul 7, 2026

Choose a reason for hiding this comment

Uh oh!

lovkeshsharma702 Jul 8, 2026

Choose a reason for hiding this comment

Uh oh!

monrog2 Jul 8, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

muthu-ku commented Jul 2, 2026 •

edited

Loading