Release 5.4.3

New features

• DHCP Config agent - support single DHCP server for multiple DCs (SandWork instances)

Security

• Address vulnerabilities in python projects

Improvements

• [SD] - Selecting range of entries in logs

• Reconciliation sends logs too much data to audit logs

Bug fixes

• [API] checkOtherPods - Workflow input incorrectly persisted in NS create/merge

• [SD][UI] Tacas input accepts special characters

• [SD] - RMA - Unable to push config snapshot on to the New Device( Authentication Failure)

• [SD] - Multiple checkboxes display as selected when only one is clicked in the reconciliation page

• [SD] - Issues  when uploading a huge brownfield file

• [SD] - Workflow details not showing up when there is some issue on the device reconciliation.

• [SD] - Filtering does not work in the device reconciliation page for the ignored intents

• [SD] - DHCP relay being ignored in upload file

• [SD] - Error when creating a VXLAN Network Segment1

• [SD] - When adding/editing SNMPv3 user, priv protocol and priv password are not saving

• [API] Brownfield - Skip existing fails on VLAN

• [UI] Pass custom create/merge NS settings in the input

File model changes

Open

Release 5.4.2

New features

Improvements

• [SD] - port settings - need to be able to change multiple selected ports

• [SD] - Port speed change - blank form on spine interface

Bug fixes

• [SD] - device reconciliation error on default values.

• [SD] - bgp neighbor created via UI does not save it as enabled: true

• [SD] - portal adding default values on update of route-maps, resulting in reconciliation error

• [SD] - Interface speed change

• [API] BGP - BGP neighbor - using L2 VPN EVPN - AllowOwnAsNumberInAsPath.Empty = true leads to reconciliation conflict

• [UI] BGP - New BGP Neighbor missing origin toggle

Release 5.4.1

New features

Improvements

• [SD] - [Improvement] Add API to GET interfaces pagable

• [SD] Execute reconciliation on devices in parallel in batches

• [UI] Adjust UI for the verbosity level flag

• [UI] Enforce enable duplicate address detection for all VRFs

• Allow user to set verbosity in tacacs and snmp pipelines.

• Make firewall portchannels optional for BLs

• Optimize db query when obtaining BGPs dependent on Route Maps

Bug fixes

• [SD] - After failed reconciliation, devices are moved from CONNECTED to MANAGED_CONFLICT stage

• [SD] - Cannot import Brownfield file with BGP neighbor referencing Vlan1 interface

• [SD] - Conductor DB queries generate large WAL for database

• [SD] - Device Reconciliation issue

• [SD] - Device Reconciliation issue

• [SD] - Import Brownfield file from device intent download file

• [SD] - Parallel brownfield pull operations cause workflow timeout

• [UI] [Improvement] Add warning message for the user when removing BGP config

• [UI] Add workflow identifier to TACACS workflow

• [UI] Adjust default values for peer group/neighbor peering parameters

• [UI] Advertise all VNI is only supported on default VRF

• [UI] Bgp - Different behaviour for Neighbor/PeerGroup creation

• [UI] BGP Create redistribute in unicast misplaced

• [UI] Bgp creation do not allow to pick currently processed VRF BGP

• [UI] BGP Creation Redistribute is nested under the aggregate

• [UI] BGP Detailed Editor - aggregate is added even if it didn't exist

• [UI] BGP Detailed Editor BGP Peer Group L2VPN EVPN no styling

• [UI] Bgp intents - missing validations

• [UI] Brownfield - after replacing uploaded file, original is submitted to backend

• [UI] Cable check - Visualization - restore size of the canvas

• [UI] Console errors - Error parsing workflow identifier

• [UI] Create BGP -> Create Peer Group Route Maps buttons misplaced

• [UI] Create NS - ipv6 Subnet incorrectly mapped to Anycast Gateway

• [UI] Create NS - user inputs - Grouping control is missing

• [UI] Greenfield - Download RAD button - id is incorrect

• [UI] Greenfield init - SNMP general - no validation for required fields

• [UI] Greenfield init wizard - GFS - fix view

• [UI] Invalid sequence number fails in ambiguous way

• [UI] Network segment Creation, Network Segment header needs to be bolder

• [UI] NS create wizard - id of M flag checkbox is missing

• [UI] Routing policy/BGP Editor Detailed editor button is cut off at the top

• [UI] SNMP/push - no device stage warning - api call is missing

• [UI] The BGP Creation property toSave is malformed

• [UI] Workflow details refreshes to default tab periodically

• [UI/API] Asking workflow info from old endpoint leads to polluting logs with long stack trace

• [API] AAA - can be submitted without methods

• [API] Bgp under default vrf cannot be deleted until non-default vrf bgp present

• [API] Cannot import Brownfield after pulling neighbors - use skip existing - some BGP constraint

• [API] Configuring BGP doesn't replace existing config

• [API] Pull Neighbors - fix workflow status to properly obtain PARTIAL_SUCCESS/WARNING

• [API] Pull neighbors - unnecessary cable check that fails - no neighbors generated

• [API] Removing of BGPs from defaut and another vrf finishe with Sonic error

• [API] Routing policy - cannot create routing map using matchSourceVrf = default

• [API] TACACS - do not expose passkey in error log

• [API] Unable to remove switchport mapped to NS with pushConfToBls=false, defaultVlan=vlanNum

• [API] Update of BGP neighbor unassign PeerGroup

• [API][Improvement] Brownfield pull: Analyze and come up with a solution how to make a clearer output when device is not reachable or not in Managed stage.

• [BE] Creating a new addressFamilyIpv4Unicast in peeringParameters of th BGP Peer groups results in an incorrect devic configuration

• [BE] Incorrect validation result for Route maps with duplicate name in the device scope

• [BE] RouteMap action sequence number validation missing

• [DevOps] Audit log secret getting created when not needed

• NS merge doesn't update subnet description

File model changes

File model changes

Open

Release 5.4.0

New features

GFS - Support for TACACS+

Adds support for configuration of TACACS+ AAA via SandWork as part of Global Fabric Settings. The configuration is also available during Greenfield initialization process.

Split VLAN-VNI mapping

The goal of this use-case is to provide ability to separate VLANs on different PODs. This is achieved by creation of network segments with same VLAN but different VNI on different PODs.

Changes on backend

• Update subnet overlapping check to also include VRF, meaning that subnet should be unique per POD and per VRF. If checkOtherPodsForSubnetOverlap is set to true, subnet should be unique per VRF in all PODs.

• Update create NS to be able to store border leaf vlan (will be used as default vlan) when Push config to border leaves is set to false

Changes on UI

Network Segment creation wizard will be reworked to give user the ability:

• To create multiple Network Segments on multiple PODs in one operation.

• To create multiple Network Segments each on a different POD in one operation.

In Network Segment creation wizard, Border Leaf VLAN input field will be renamed to Default VLAN. It will be used as automatic VNI to VLAN mapping on step 5 of switchport mapping creation. Also, if Push Configuration To Border Leaves is set to true, Default VLAN will be configured on POD border leaves.

In cluster Zero-Trust communication (L7)

SandWork is prepared to be integrated with Istio Service Mesh to allow Zero Trust Communication
between in-cluster services.

This integration supports Istio in Ambient mode and utilizes Kubernetes Gateway API.
Ambient mode brings in efficient deployment model and resource utilization compared to sidecar mode, while the Gateway API ensures the integration is as generic
as currently possible and gives possibility to integrate with another compliant Service Mesh in future.

This functionality is disabled by default as it has prerequisite cluster side configuration.

See deployment guide for further information.

Bug fixes

• [API] Brownfield import - SNMP exists / fields that do not go through deserialization - unfinished error output

• [API] Configure Routing policy - Management0 port is not allowed as Matching interface on device

• [API] Configure SNMP - workflow output - duplicated sections

• [API] DC plan import - bad request

• [API] Find device by MAC - Not found TOR devices error (SONIC 4.1.x)

• [API] OS Upgrade - cannot move device from OS_INSTALL_FAILURE to Managed/Config_Pending

• [API] Push GFS SNMP - switch to another type of listening interface - NullPointerException at getAddressWithoutMask

• [API] SNMP - community string - missing validations

• [API] SNMP - community string cannot be null

• [API] SNMP - community string diff should be clearly reported in reconciliation

• [API] SNMP - config request fails if ni_snmp_config is empty

• [API] SNMP - only v3 - Reconciliation fails - "inventoryGeneralConfig" is null

• [API] SNMP/configure - request to copy passwords from source pod to another pod using only v3 fails

• [API] snmp/configure - treat empty objects as it is absent

• [API] Changes in "advertiseRoutesIpv4Unicast" and "advertiseRoutesIpv6Unicast" are not reflected on device
  [API] Creation of addressFamilyUnicast without maxPathsEbgp/Ibgp causes reconciliation failure
  [API] dup-addr-detection cannot be false under non-EVPN VRF

• [BE] Cannot edit BGP in BGP management without prefixes for IpV4Unicast and Ipv6Unicast

• [BE] Device reconciliation after modifying description of the BGP configuration results in exception

• [BE] Incorrect validation result for prefix lists with duplicate name in the device scope

• [BE] SetCommunity parameter for route map sent from BE always has null value

• [BE] Update of bgp as path list not reflected on device

• [BE] Updating BGP neighbor intents from the device causes reconciliation errors

• BE] Cannot configure peerGroup.peerigParams.remoteAsNum on the device when it has a number value

• [BE] Removing Route Map IN&OUT from BGP Peer Groups doesn't remove it from the device

• [DevOps] Disable caching for translation files in portal frontend

• [DevOps] Grpc server port in service-controller should be configurable

• [SD] - [API] DC import - unnecessary long results

• [SD] - Add support for openconfig-routing-policy-ext:ADDITIVE

• [SD] - java.lang.IllegalStateException: Duplicate key during brownfield loopback pull on POD0 BL

• [SD] - Leftover datacenter name in RBAC DB assigned to user causes unhandled exception

• [SD][UI] Extend setCommunity reserved values for route map actions

• [UI] Best path selection section is not visible when editing an existing BGP configuration

• [UI] BGP config edit - blank and fills console with error

• [UI] BGP configuration cannot be saved when the bestPathSelection is not null

• [UI] BGP configuration edit -> wrong input type of asNumberCount parameter

• [UI] BGP Creation - allow using existing peer groups

• [UI] BGP Creation - Unable to add new aggregate - console error

• [UI] BGP Detailed Config Editing creates a duplicate entry

• [UI] BGP Detailed Editotr Graceful Restart missing props

• [UI] BGP editing does not work because FE sends "peeringParameters": null when no peering parameters are changed, causing the workflow to fail

• [UI] BGP Editor - ipv4/ipv6 aggregate address - incorrect field name

• [UI] BGP neighbors - discard button stops working after removing item

• [UI] Brownfield pull output - the import button should prefill pulled brownfield

• [UI] Configure SNMP workflow - sidebar - button missing text

• [UI] Create BGP Neighbor button misplacement

• [UI] Data loading of BGP configuration failed after making changes to the BGP config

• [UI] GFS SNMP - Unable to save only v3 configuration

• [UI] Greenfield init - SNMP general - it expects both toggles to be set to true

• [UI] Greenfield init - step2 - wizard does not remember Routers count

• [UI] Incorrect request parameters when modifying an existing BGP configuration in detailed config view

• [UI] Invalid sequence number fails in ambiguous way

• [UI] Nested Actions when copied are not highlighted

• [UI] Push GFS SNMP - Fix start toast title

• [UI] Push GFS SNMP - user inputs - do not use device id in the metadata

• [UI] Reconciliation does not report unreachable devices

• [UI] Removal of of BGP not working

• [UI] RouteMap creation automatically sets setLocalPreference to 0

• [UI] Routing - removing entries in tables causes position reset

• [UI] Routing - warn user about the device not being in Managed stage

• [UI] SNMP - Cannot send V2 without general config

• [UI] SNMP - community string - missing validations

• [UI] SNMP - v3 - users - if subtrees are null, SNMP cannot be submitted

• [UI] SNMP Create User issues

• [UI] SNMP/configure - apply limits to OID tree length

• [UI] SNMPv3 - Fix validations and inputs

• [UI] SNMPv3 - implement validation on changes of existing config

• [UI] Some table have paginators half hidden

• [UI] UI send only one Bgp to save

• [UI] UI sends the whole BGP Config even for parts that were not updated

• [UI] User inputs of a prefix list is not visible on small screens

• [UI] When creating multiple VXLAN segments, frontend sends null values for managedConfig & otherConfig

• [UI] When editing a BGP configuration, the ipv4Unicast and ipv6Unicast objects are sent with incorrect structure

• [UI] Missing field and typo in Remote As

• Device cleanup does not remove all intents

• Prefix list actions can become misordered on update

Improvements

• [API] Adjust inventory models to cleanup generated file modes

• [DevOps] Configure default resource requests for each component

• [SD] - [Improvement] [API] Improve config update with wildcard passwords

• [SD] - Support with nginx ingress compression configuration

• [SD] Remove configurationConflict from reconciliation push GFS inputs

• [SD][UI] Reconciliation - PUSH - Adjust to changes

• [UI] - Dialog focus highlights issues

• [UI] Extend brownfield file response details with podErrors

• [UI] SNMPv3 user creation dialog - allow null subtrees

• Don't remove location and contact when configuring SNMP

• Handle not configured 'trap enable' as disabled

• Remove schema-cache from service controller configuration

• Review and address vulnerabilities in backend components

Known issues

• [API] Bgp under default vrf cannot be deleted until non-default vrf bgp present

• [BE] Creating a new addressFamilyIpv4Unicast in peeringParameters of th BGP Peer groups results in an incorrect devic configuration

• [UI] BGP Create redistribute in unicast misplaced

• [UI] Bgp intents - missing validations

• [UI] Handle case when in worklfow details the accordion is collapsed

• [UI] [Improvement] Add warning message for the user when removing BGP config

• [UI] The BGP Creation property toSave is malformed

• [UI] The input preview for BGP has unneccesary properties

• [UI] Greenfield init - SNMP general - no validation for required fields

• [API] OS Upgrade - Ports status mismatch after the rerun of failed upgrade

• [UI/API] Asking workflow info from old endpoint leads to polluting logs with long stack trace

• [SD] - Parallel brownfield pull operations cause workflow timeout

• [UI] Topology view - Show more details of the devices from another PODs

• [UI] - Switchport mapping wizard - device ordering changed after selecting port

• [UI] Reconciliation - User Inputs - Device connectivity column could be missing

• [UI] Finish toasts might not appear

• [UI] Ports screen - clicking on a pencil icon - icons and buttons blink

• [UI] Fix lag on workflow sidebar navigation

• [API] Unordered import of DC - Cable check fails - MISSING_NEIGHBOR for all the links

• [UI] Wrong error message when login was successful, but first request fails with 401

• [UI] Call to /api/gateway/workflowDetailsInfo/ could end up looping until workflow ends

File model changes

File models for 5.4.0

Open

Release 5.3.0

New features

GFS - Support for SNMPv3

Introduce the capability to configure and reconcile SNMPv3 configuration intents as part of the Global Fabric Settings.

This introduces following SNMPv3 configuration:

• Views

• Users

• Groups

• Trap Hosts

The reconciliation of SNMPv3 keys is currently not possible as the original passwords are stored and returned as hashed values.

NSX - Route Maps - update device config

Adds the capability to define new Route Maps via SandWork UI and push the intended configuration (including delete/update operations) to the switch.