IP Fabric v5.0

v5.0.2 (Sep 13th, 2022)

# ipfabric-5-0-2+5.ova
QCOW SHA256: ebe63a21be1a1a8d0bf5897f8c8887b732505f2c4a1afc94fc779752f4c968b0
QCOW MD5: c151ad5e9b028c29c88fc67b7007bdaa
# ipfabric-5-0-2+5.qcow2
TAR SHA256: 7ccd1e349ec8a77680db95637abc1699dfd1755a63d8075d37baece5cac9eb50
TAR MD5: 65f2602ddbf5a8dc56d67eab430f13b1
# ipfabric-update-5_0_2+5.tar.gz.sig
TAR SHA256: 1dc0a59e2ec0993b9af2f7e26547caa791114ce5d49da32387effa00f11bbc95
TAR MD5: 62518242728b95c08f5362ebcddec140

Bug Fixes

• Juniper – Device info task failed to read inventory data
• Jumphost settings – removing the username restriction
• Vendors API – Updated resources management when reading Versa SD-WAN
• Configuration backup – File download failed with large configuration files
• Intent Calculation failed for complex ZoneFW policies

Features

• FabricPath – Add feature-set support for Cisco Nexus

v5.0.1 (Aug 08th, 2022)

# ipfabric-5-0-1+10.ova
OVA SHA256: 6ec97dde3bc7b4eae424799838a99453d759adf14ef42f20039fc89cd0c2eb49
OVA MD5: 4624340f1f6c515db0946b859944558e
# ipfabric-5-0-1+10.qcow2
QCOW SHA256: 7539bbaf7eb6c8f7c5e0c72517210e49feec0bb2ae9cca68bb900321d56d2996
QCOW MD5: 04fed50a120a49bf1b610b39096b1051
# ipfabric-update-5_0_1+10.tar.gz.sig
TAR SHA256: edbf3cfa8c0628b39682a952f61d62ba7b3ea9176c5f36edd1b93decee501047
TAR MD5: 0f79000974e0e5c60590e161785a1067

Bug Fixes

• v5.0.0 was unpublished as a race condition in Palo Alto discovery was reported; this has been fixed in v5.0.1.

Features

• Checkpoint Management Data Plane Separation (MDPS) if enabled is now supported in IP Fabric for discovery

v5.0.0 (Jul 19th, 2022)

OVA SHA256: ac8a7e68f97b53e299ce3eecac6bd4ddc56c2c025b1ae48d95fbad925213a7bd
OVA MD5: 65e979f0ea93ba77c9731cfcc0008fa5
QCOW SHA256: 1e681e249d69d21feb83cbc62f5e3d2bb80db76d22a3acfd90c840c30506748c
QCOW MD5: 0204de624001d1dfe8067e68f11ef3c5

UPGRADE NOTICES

• This upgrade requires IP Fabric to be on v4.4.3 prior to upgrade to v5.0.0. IP Fabric v4.4.2 or lower will not work -– please upgrade to 4.4.3 using the normal method before carrying out the 5.0.0 upgrade process.
• Due to the major changes stated above, automatic updates will be disabled for this release and will require manual upgrade.
• Prior to update please ensure you perform a backup of your system or it is highly recommend to create a VM snapshot
• It is recommended (for all updates) to unload all snapshots prior to performing the upgrade.
• Requires 10GB of free disk space.
• Estimated upgrade time is around 20 minutes however depending on the resources of your VM it could take longer than an hour.
• During update to 5.0.0 no message about the update being finished is shown and a refresh of the Admin page is required to check if the API and services are back online.
• After approximately 5-10 minutes after the update file has finished uploading to the server you should be able to log into the IPF CLI as osadmin and run the following command to track installation progress
  • tail -f /var/log/nimpee/dist_upgrade.log
  • If tail command is not found wait a few minutes and log out and back into the CLI.
• Once upgrade has finished the system will reboot (see below the example output of the dist_upgrade.log file).
• After all updates please Clear Browser Cache.
• Not all new features will be available until a new snapshot is created on the updated version.
• If after the upgrade you experience issues with AQL: internal error, Dashboards, or Topology please first try restarting the ArangoDB service from the System Administrator page prior to contacting support.
  • Log into the System Administrator Page located or port 443
  • In the System Status page under System Services you will find ArangoDB
  • Next to the status color is a restart button which will restart the service
• If you run into any other issues during or after the upgrade please open a support ticket.

Example output of successful /var/log/nimpee/dist_upgrade.log log file:

osadmin@ipfabric:~$ tail -f /var/log/nimpee/dist_upgrade.log
+ echo — exit_code: 0, cleaning up —
--- exit_code: 0, cleaning up —
+ delete_if_exists /etc/apt/sources.list.d/ipf-update.list /etc/apt/sources.list.d/ipf-update.list.tmp /etc/apt/sources.list.tmp
+ [ -e /etc/apt/sources.list.d/ipf-update.list ]
+ [ -L /etc/apt/sources.list.d/ipf-update.list ]
+ [ -e /etc/apt/sources.list.d/ipf-update.list.tmp ]
+ [ -L /etc/apt/sources.list.d/ipf-update.list.tmp ]
+ [ -e /etc/apt/sources.list.tmp ]
+ [ -L /etc/apt/sources.list.tmp ]
+ return 0

New Vendor Support

• Cisco APIC discovery
  • Cisco ACI - contracts, tenants, applications, zone filtering
• Aruba Instant APs
• Ruckus Wireless controller
• Dell SmartFabric OS10 Basic Discovery
• Cisco Meraki has been migrated from API v0 to API v1
  • Following the announcement of Meraki's addition of Cisco Catalyst switches we have ensured that these will be only discoverable via CLI at this time and excluded in the Meraki discovery.

Features – Protocol and Technology Support

• IPv6
  • Dual-Stack Basic Discovery
  • Technology Tables (Routing, managed IP, hosts, interfaces)
• DNS
  • DNS Basic configuration
  • DNS Resolver configuration
• DHCP servers and relays
• Extreme ACL support
• RSVP neighbors & interfaces
• IPv4 and IPv6 Tunnels Table
• Juniper MIST Improvements
• Azure Security Groups
• AWS Network ACLs & Security Groups
• VMware NSX-T - Add support for VRF OSPF and BGP
• HP Aruba CX Dot1x
• Cisco ASA Interface Aliases

Role-Based Access Control Phase 1

IP Fabric v5.0.0 includes Phase 1 of RBAC. The most significant change is that Users are now assigned to a Role(s) and not given specific permissions. During the upgrade process your users will be migrated to the appropriate roles. For more information see the documentation at the links below.

• Policies
  • This is where you define the endpoints users have access to.
  • There are 5 built-in Policies in v5.0.0
    • settings: Access to snapshot and product settings endpoints
    • discovery: Access to discovery endpoints
    • team: Access to user management endpoints
    • tables: Access to table endpoints
    • others: Migrated read scope - to be deprecated in 5.1
• Roles
  • A Role can consist of one or more policies
  • admin role cannot be changed or deleted
• Users
  • A User can also consist of one or more roles

IP Fabric VM OS-Level Changes

• The OS has been updated to Debian 11 "bullseye"
  • openvpn version has been updated to 2.5.1
    • This version drops older ciphers, and could have an impact on users utilizing those ciphers
  • sshuttle version has been updated to 1.0.5
    • This upgrade could potentially impact jumphost connectivity
• removed jailkit for osadmin user
  • There is still the limitation for changing the osadmin account password only via running nimpee-net-config -t
  • CLI users logging in as osadmin now have sudo access

• Boot Wizard Changes
  • For VM initial deployments where console access is not possible, it's now possible to run the boot wizard via SSH
    • Boot the VM, determine the IP address assigned to it from DHCP, and SSH to the VM: ssh osadmin@<dhcp-learned-ip-address>
    • Once logged in, run nimpee-net-config -a
• cloud-init preliminary support
  • For users wanting to automate VM installations, cloud-init can be used for initial VM provisioning
  • IP address assignment to the VM is supported via cloud-init
  • Any other changes via cloud-init (users, ssh keys, resizing) may work, but are untested and unsupported
  • Changing the password for osadmin through cloud-init is discouraged as it has some implications, use nimpee-net-config -t instead
  • If you are using auto cloud-init via certain cloud providers, note the OpenSSH server will regenerate new public/private keys
• Added qemu-guest-agent for easier monitoring in environments such as OpenStack
• Entry input validation has been improved in features such as backup, jumphosts, SNMP and certificates
  • Strings should only accept the following characters: A-Za-z0-9.,/-_@%^:=+ -
  • Previously set strings may no longer work. For example, an SNMP community string previously set with an invalid character (i.e. IPFabric&123) would cause SNMP queries not to work until the string is updated with only valid characters