Skip to content

IP Fabric v8.1

Upgrade Version Policy

We support the following upgrade paths:

  • The latest version in the previous major line → any version in the current major line (for example: 7.12.5 → 8.0.10).
  • Any version in the current major line → any newer version in the current major line (for example: 8.0 → 8.2).
  • An upgrade to 8.2 can be only performed from version 7.12.5 or newer.

Clearing Browser Cache

After upgrading IP Fabric to a newer version, you should see the Your application has been updated and must be refreshed dialog in the main GUI.

It is usually sufficient to just click the Refresh button.

However, in case of issues with the main GUI or if you did not see the mentioned dialog, please force refresh your browser cache.

The key combination for doing this depends on your operating system. In your browser window with your IP Fabric appliance’s URL open, use one of the following key combinations:

  • Windows: Ctrl + F5
  • macOS: Command + Shift + R
  • Linux: Ctrl + F5

This will only affect the browser cache for the IP Fabric appliance.

Breaking Change

Stop and Force Stop Merged into Cancel

The separate Stop and Force Stop actions for a running Discovery are now replaced by a single Cancel action:

  • Stop previously halted device discovery gracefully but still ran Topology Calculation and Assurance Engine checks over the partially discovered data.
  • Force Stop previously skipped that step and immediately marked the snapshot error and Force Stopped.
  • Cancel now stops the process immediately. Topology Calculation and Assurance Engine checks do not run for the partially discovered data. The snapshot moves to the canceled state instead of error.

The same Cancel action, with a confirmation dialog worded for the active process, works consistently across Discovery, Snapshot Load, and Topology Calculation. See Canceling a Running Process for details.

Version 8.1 removes the POST /jobs/{key}/force-stop API endpoint. Use POST /jobs/{key}/stop instead, which now provides the immediate-termination behavior previously exclusive to Force Stop.

Migration

Update any automation, scripting, or internal documentation that calls POST /jobs/{key}/force-stop or references the Force Stop action. Also update anything that checks for a Force Stopped/error snapshot after a manual stop. The endpoint no longer exists and the resulting state is now canceled.

PHP CVEs (IP Fabric is not impacted)

CVE-2026-109618 / CVE-2026-109619

Following the public disclosure of these PHP vulnerabilities, we assessed our products and services. The IP Fabric appliance is not impacted. Neither are our supporting websites, including the upload and releases portals. No action is needed on your side for these CVEs.

v8.1.8 (October 27th, 2026; GA)

SHA256 (ipfabric-update-8-1-8+0.tar.zst.sig) = e7a62542d3a6f2f9cf19c299aa036e9021176cc81f5963660bb876a384e4a26c
MD5 (ipfabric-update-8-1-8+0.tar.zst.sig) = bfd804b5ace1a7e40f880bcd2a57315c
SHA256 (ipfabric-8-1-8+0.qcow2) = bebb5e790d1dda62385575422a8d7d61e634198ee69fd5784e28071b206897f8
MD5 (ipfabric-8-1-8+0.qcow2) = e60d754b13de54e9d19a50f3a2b0f0af
SHA256 (ipfabric-8-1-8+0.vmdk) = d74491729a059489f848a3759d155051031ce54b8dba48fe15a7884aa50fbd9d
MD5 (ipfabric-8-1-8+0.vmdk) = 8c8c413163cadc6b7b15931169be2563
SHA256 (ipfabric-8-1-8+0.vhdx.zst) = 25452e10abef4c80f89d14612f4ebda1cedd582497df251b9f1e623f4ed89903
MD5 (ipfabric-8-1-8+0.vhdx.zst) = 70eb4c6fe5cf8a308f47014e891959f3
SHA256 (unsupported-ESXi6.7U2-ipfabric-8-1-8+0.ova) = 5f83e2161e81c06b7409f0b1403044ab2d4fee9dd746f415708839b5e403d887
MD5 (unsupported-ESXi6.7U2-ipfabric-8-1-8+0.ova) = b2d747b978e364798b700b52ffc57d15
SHA256 (unsupported-ESXi7.0-ipfabric-8-1-8+0.ova) = 36bb2340aab6e7c9c5d3c2b0831660023c2a3d6c997bf529eb7f8c346b31bf07
MD5 (unsupported-ESXi7.0-ipfabric-8-1-8+0.ova) = bd5f5e509dfe85556e904bb890895657
SHA256 (ESXi8.0-ipfabric-8-1-8+0.ova) = 184e33a12a26597b8f0140ad5797bb6bd3753b6425ea799668ad63c481983568
MD5 (ESXi8.0-ipfabric-8-1-8+0.ova) = c480efe6b740f5bc077b09071d749673

Improvements

  • Changed the MCP ipf_api_endpoint_details tool to keep schema field descriptions and return them on demand.

Bug Fixes

  • Fixed RabbitMQ journal logs.

v8.1.7 (October 22nd, 2026; GA)

Improvements

  • Raised the MCP server’s Express express.json() request body limit from 100 KB to 20 MB to match the product API.

Bug Fixes

Topology

  • Fixed topology calculations becoming stuck at “Formatting graph edges”.

Security

  • Includes multiple high-severity security updates.
  • Resolved the “DROP: Security evaluation error” during security evaluation.

Microsoft Azure

  • Stopped the routingTable task from emitting the Could not find the VNET for the Load Balancer error for managed load balancers without a customer VNet.
  • Fixed privateEndpoints mapResult failures for non-provisioned private endpoints missing networkInterfaceId.
  • Fixed dnsResolvers/inboundEndpoints mapResult failures for non-provisioned endpoints missing ipAddress.
  • Fixed mapAzureResult validation errors when serviceType is undefined for cross-tenant or external Private Link services identified by FQDN.

UI

  • Fixed false-positive visual changes in the Components/License Usage/Default Storybook story.

AIM

  • Fixed Illumio PCE imports failing in tasks/aim/workloads when a workload has an empty description.

v8.1.5 (October 16th, 2026; GA)

Improvements

  • Significantly accelerated the getSwitchToAP step of topology calculation.
  • Updated the CCU license guide tiering.

Bug Fixes

Discovery & Device Support

  • Fixed discovery of Fortinet FortiGate devices with special banner prompts that previously produced no prompt match.
  • Corrected the command used to retrieve ESN information from Huawei devices.
  • Enabled ZPE Nodegrid discovery commands to use the cli prefix when SSH opens in the Linux Bash shell instead of the Nodegrid CLI.
  • Prevented Tasker from failing when AWS discovery produces a large number of errors.
  • Fixed ABParseError caused by VPN site addressPrefixList validation failing with “Invalid input”.
  • Fixed gateway validation that required at least one of remoteGwAddress or remoteGwAddress6.

Parsing & Data Accuracy

  • Corrected IS-IS parsing on Arista EOS devices.
  • Fixed SNMP parsing errors on Cisco devices.
  • Corrected Cisco IOS-XE stack fan parsing from show env stack, so FAULTY fans no longer appear as fanState not in the Fans inventory table.
  • Fixed the Cisco Unidirectional Link Detection (UDLD) task failing with ABCommandFailed.
  • Fixed Extreme VOSS LACP parsing that reported configuration for an unknown MLT interface.
  • Fixed IGMP snooping parsing failures with the validation error “groupList[0].type is not allowed to be empty”.
  • Fixed security rule pre-processing failures caused by unmappable security rules.
  • Standardized MAC address formatting for L2 interfaces.

Path Analysis

  • Fixed Palo Alto firewalls (e.g., PA-7050) being omitted from Host-to-Host and End-to-End paths between Cisco Catalyst 9500 border and fusion routers.

Snapshots

  • Preserved or recreated global attributes used for manual site separation when unloading and reloading older snapshots.

UI, Dashboard & Reports

  • Fixed the STP Instances page returning no data and the error “A request /tables/spanning-tree/instances failed to fetch, HTTP status: 502”.
  • Fixed Dashboard > Discovered Devices displaying NaN instead of 0 for Added and Removed devices when the related API values are null.
  • Restored missing information in the Summary of Issues section of the Discovery Connectivity report.
  • Fixed frontend caching errors occurring after an IP Fabric upgrade.

AIM

  • Relaxed the Illumio workloads data contract to allow null osType, osDetail, and ipAddress properties.
  • Set a single 20 MB request limit for POST /aim/import/{snapshotId}, enforced by nginx, and removed the separate per-file limit.

v8.1.4 (October 2nd, 2026; GA)

Application Infrastructure Mapping (AIM)

API

POST /aim/import/{snapshotId} now accepts the data either as uploaded CSV files or as a JSON payload in the request body. Both encodings carry the same fields and apply the same validation and merge rules, so either can be used interchangeably. JSON additionally allows native types and structured workload labels, which the packed key=value CSV column cannot express. See AIM API.

A JSON payload is validated row by row before the import job is scheduled. Invalid rows are rejected immediately with 422 and the array, row index, and property of each bad value, instead of surfacing later as a failed job. Cross-references between applications, workloads, and flows continue to be checked inside the job.

The endpoint now also accepts the $last, $lastLocked, and $prev snapshot keywords in place of a snapshot UUID.

Migration

The background job scheduled by POST /aim/import/{snapshotId} is now named aimImport instead of aimCsvImport. The upgrade renames existing job records as well, so the Jobs table reports the new name for past imports too. Update any automation that filters on "name": ["eq", "aimCsvImport"].

MCP Server

AIM data can now be imported through the IP Fabric MCP Server, which sends the JSON payload – so the whole AIM workflow, ingestion included, runs from an AI assistant. Uploading CSV files still requires a normal HTTP client. See Using AIM Through the MCP Server.

Improvements

  • Improved topology calculation performance by speeding up graph edge sorting

Bug Fixes

Discovery

  • Fixed devices remaining in the processing state in the Connectivity Report after discovery finishes
  • Fixed discovery failing with the Unexpected end of JSON input error in the IPF-API DataLoadingScenario component
  • Fixed discovery services not stopping when the IPF-API DataLoadingScenario component reports an error during discovery
  • Fixed the VeloCloud API snapshot settings failing to save
  • Fixed auto-assigned public IP addresses not being collected by the Cloud/PublicIP task on AWS

Topology Calculation and Snapshots

  • Fixed topology calculation taking about two hours on large snapshots during VLAN topology calculation
  • Fixed Tasker calculation time growing by about 5 minutes for every additional loaded snapshot
  • Fixed Maintenance taking a very long time or getting stuck when a snapshot is in the error state

Configuration Management

  • Fixed the collect device configurations job not being possible to force stop
  • Fixed configuration collection getting stuck when the appliance is rebooted while it is in progress
  • Fixed the Last Check At date in Management > Configuration not being updated when configurations are pulled and unchanged

Parsing

  • Fixed missing SFP transceivers in Part Numbers on Cisco NX-OS NX3000 devices by using the show inventory all command
  • Fixed interface media type not being populated for Cisco NCS 560 devices running IOS-XR

v8.1.3 (September 23rd, 2026; GA)

Application Infrastructure Mapping (AIM)

A new premium add-on that correlates your application inventory – applications, workloads, workload interfaces, and flows – with the discovered network, and calculates which network devices an application’s traffic traverses. Requires the AIM feature in the product license. See Application Infrastructure Mapping (AIM).

Ingestion

Data can be retrieved from an Illumio integration, maintained manually or imported from CSV in Settings > Discovery & Snapshots > Discovery Settings > Application mapping, or imported over the API. See Application Mapping.

Inventory

Inventory > Applications lists applications, workloads, flows, and the devices the flows traverse. See Applications.

API

POST /aim/import/{snapshotId} imports AIM data from CSV files, and POST /aim/flow-path-lookups/{snapshotId} calculates the traversed devices on demand. See AIM API.

MCP Server

The whole AIM workflow, excluding the API data import from CSV files, can be driven from an AI assistant through the IP Fabric MCP Server. See Using AIM Through the MCP Server.

Path Lookup

Path lookup address fields suggest application and workload names alongside IP addresses and DNS names. See Searching by Application or Workload Name.

Run Topology Calculation

A new button, available for canceled snapshots from the overflow menu next to Load/Unload Snapshot, lets you manually trigger Topology Calculation and the Assurance Engine checks over partially discovered data without needing a full snapshot reload. See Canceled Snapshots for details.

New Site Separation Rule: Cloud Tags

Site separation now supports a new rule type. It groups cloud resources into sites based on the value of a chosen AWS, Azure, or GCP tag. For example, resources tagged Environment=prod are assigned to the prod site. A rule can include many tag names. If a resource carries more than one matching tag, the first tag name in the list determines the site. See Site Separation for details.

Cloud Licensing (CCU)

Licenses can now use a new Cloud Connectivity Unit (CCU) licensing strategy for cloud infrastructure discovery. Cloud constructs no longer count against the on-premises device limit.

IP Fabric gives each cloud construct a pricing tier. Tier A costs 1 CCU, Tier B costs 0.5 CCU, and Tier C costs nothing. Each construct then draws CCUs from a dedicated CCU limit on the license. Licenses without a CCU limit keep the previous device-count strategy.

To see CCU usage and the tier of each discovered cloud construct, navigate to Settings > Administration > License overview. See License Consumption Overview and Licensing for details.

Improvements

Fast Discovery for Cisco Wireless LAN Controllers

For more information about this feature, see Experimental Features.

Technology Tables

  • MAC Table (Technology > Addressing > MAC Table) – The table now includes SPBM next-hop information in three new columns. See Shortest Path Bridging MAC (SPBM) for details.
    • SPBM I-SID – The service instance identifier the MAC address belongs to.
    • SPBM B-MAC – The destination backbone MAC address the entry resolves to.
    • SPBM B-VLAN – The backbone VLAN that carries the traffic.
  • Cloud Security (Technology > Cloud > Security) – New inventory table listing security policies (security groups/NACLs/firewall policies) across cloud vendors, at /technology/cloud/security. It shows the number of inbound and outbound rules per policy. Clicking a count opens the rule tree for that policy and direction. The New Cloud Model feature flag must be enabled to use this table.
  • Cloud Network Interfaces and Cloud Subnets – These tables now include a Security column showing the security groups/policies applied to each interface or subnet, linked to the new Cloud Security table. Enable the New Cloud Model feature flag to use this column.

Path Lookup

SPBM L2 VSN Services

Path lookup now follows SPBM L2VSN services. It traces traffic from the ingress backbone edge bridge (BEB) across the backbone core bridges (BCBs) to the egress BEB. Each hop displays in the path. See Shortest Path Bridging MAC (SPBM) for details.

Vendor Support

Arista EOS

Interface Media Type – IP Fabric now collects the media type for Arista EOS interfaces (e.g., 1000BASE-T, 10GBASE-SR). The Media column in Inventory > Interfaces now displays data for Arista EOS devices.

AWS

IAM Policy Update – IP Fabric updated the AWS IAM policies to resolve missing permissions issues. If you use AWS API discovery, update your IAM policy:

For details, see AWS API Configuration – Required IAM Policy.

GCP

  • Firewall Policies – IP Fabric now collects GCP hierarchical firewall policies, and network and regional firewall policies, also collecting existing firewall rules. These display in the new Cloud Security table. Path lookup was updated with new packet selectors to evaluate these policies. Rules that match on secure tags, target resources other than VM instances, or contain only IPv6 ranges are currently excluded from path lookup evaluation. Available when the New Cloud Model feature flag is enabled.
  • Address Groups and Target Networks – GCP firewall rule collection now includes address groups and target network scoping. Only IP address groups are supported; FQDN-type address groups are not currently collected. Available when the New Cloud Model feature flag is enabled.
  • Load Balancer NEG Backends – IP Fabric now collects regional and global Network Endpoint Group (NEG) types for GCP, also collecting existing zonal NEGs, and resolves them as load balancer backends in path lookup. Before this release, path lookup did not resolve NEG-backed load balancers. IP Fabric does not collect Serverless and Private Service Connect (PSC) NEGs. FQDN-based NEGs are collected but not resolved to a path-lookup hop.
  • Resource Manager Tags – IP Fabric now collects GCP Resource Manager tags. In Technology > Cloud > Nodes (/technology/cloud/nodes/inventory), the Tags column now shows these Resource Manager tags instead of labels. This also feeds the new Cloud Tags site separation rule for GCP resources.

ZPE Nodegrid

IP Fabric now supports basic discovery of ZPE Nodegrid out-of-band management devices. Coverage includes interfaces, ARP, IPv6 neighbors, routing table, serial ports, configuration backup, and management services. See Feature Matrix for details.

Disabled by Default

To enable it, set the ENABLE_DISCOVERY_DEVICES_ZPE feature flag. See Feature Flags for details.

FS (FSOS)

ACL (Technology > Security > ACL) – IP Fabric now collects ACL data for FS switches.

FSOS ACL Coverage

Supported: the S3900 family. Not supported: other FSOS models (e.g., S5850, N8560, T5850) – ACL data collection may not work correctly on those models.

Experimental Features

Fast Discovery for Cisco Wireless LAN Controllers

A new feature flag ENABLE_WLC_FAST_DISCOVERY reduces discovery time for Cisco Wireless LAN Controllers. When enabled, IP Fabric collects access point and wireless client data using controller-wide (bulk) CLI commands instead of running per-AP and per-client commands. This reduces the number of CLI commands and the duration of the wlcApList and clientList discovery tasks.

Supported on Cisco AireOS controllers running AireOS 8.1 or newer, and on Cisco Catalyst 9800 (IOS-XE) controllers. IP Fabric discovers controllers that do not meet the version requirement in full mode even when the flag is enabled. Task names, output schemas, and API responses remain unchanged, so no downstream configuration is affected.

Disabled by default. To enable it, see Feature Flags.

Labels

Devices and L2 interfaces can now be tagged with labels in the name:value format (for example, region:EMEA or pci). Labels are managed in a new Settings → Discovery & Snapshots → Discovery Data Enrichment page.

You can assign them manually, apply them automatically with rules that match device properties, or let L2 interfaces inherit them from their device.

Assigned labels appear as a filterable Labels column across technology tables, and you can edit them in place from Device Explorer. You can also use them to scope intent checks and import them through the API.

Labels work alongside device attributes, which remain unchanged. See Labels for details.

Disabled by default. To enable it, see Feature Flags.

ZPE Nodegrid Discovery

Disabled by default. To enable it, see Feature Flags.