Skip to content

IP Fabric v7.3

Upgrade Version Policy

We support the following upgrade paths:

  • The latest version in the previous major line → any version in the current major line (for example, 6.10.7 → 7.3.15).
  • Any version in the current major line → any newer version in the current major line (for example, 7.0.15 → 7.3.15).
  • An upgrade to 7.5.X and later can be performed solely from the latest 7.3.15 release.

Required Steps Before Upgrading to v7.5

The upcoming v7.5 release introduces a new PostgreSQL-based database, which brings updated hardware requirements. To ensure stability and optimal performance after the upgrade, we strongly recommend using directly attached SSD or NVMe storage. To assess your current hardware performance, use our ipf-checker tool by running sudo ipf-checker -d -s.

WARNING: The test may take a long time to complete. The default timeout is 45 minutes. We recommend avoiding any use of the IP Fabric appliance while the test is running.

Clearing Browser Cache

After upgrading IP Fabric to a newer version, you should see the Your application has been updated and must be refreshed dialog in the main GUI.

It is usually sufficient to just click the Refresh button.

However, in case of issues with the main GUI or if you did not see the mentioned dialog, please force refresh your browser cache.

The key combination for doing this depends on your operating system. In your browser window with your IP Fabric appliance’s URL open, use one of the following key combinations:

  • Windows: Ctrl + F5
  • macOS: Command + Shift + R
  • Linux: Ctrl + F5

This will only affect the browser cache for the IP Fabric appliance.

Known Issues

License or Database Errors After Upgrade

If the IP Fabric GUI redirects to the status page after an upgrade and displays errors such as License Error, ArangoDB Disconnected, or Failed to load initial app data, this may indicate an issue with the ArangoDB configuration.

"Failed to load initial app data" error

License error

To diagnose the issue:

  1. Log in to the IP Fabric appliance via CLI and switch to the root user using sudo -i.

  2. Check if ArangoDB is listening on port 8529 via IPv6 (expected for IP Fabric 7.2):

    root@IPF:~# lsof -i | grep 8529 | grep LISTEN
arangod      952    arangodb   26u  IPv6   19501      0t0  TCP *:8529 (LISTEN)

    If ArangoDB is bound to IPv4 instead, this likely causes the error:

    root@IPF:~# lsof -i | grep 8529 | grep LISTEN
arangod     874 arangodb   26u  IPv4  20599      0t0  TCP *:8529 (LISTEN)

  3. Verify the arangod.conf file in /etc/arangodb3 is a symbolic link to arangod.conf.ipf. The directory should show:

    root@IPF:~# cd /etc/arangodb3
root@IPF:/etc/arangodb3# ls -lsa | grep arangod.conf
0 lrwxrwxrwx   1 root root    16 Nov 27  2023 arangod.conf -> arangod.conf.ipf
4 -rw-r--r--   1 root root  1687 Feb 11 12:07 arangod.conf.ipf
4 -rw-r--r--   1 root root  1696 Nov 27  2023 arangod.conf.ipf-orig

If the symlink is missing (i.e., arangod.conf is a regular file):

  1. Run these commands to restore the symlink:

    cd /etc/arangodb3/
mv arangod.conf arangod.conf.bkp
ln -s arangod.conf.ipf arangod.conf
systemctl restart arangodb3

  2. Confirm the symlink exists and ArangoDB uses IPv6:

    root@IPF:/etc/arangodb3# ls -lsa | grep arangod.conf
0 lrwxrwxrwx   1 root root    16 May 27 09:30 arangod.conf -> arangod.conf.ipf
4 -rw-r--r--   1 root root  1697 May 27 09:22 arangod.conf.bkp
4 -rw-r--r--   1 root root  1693 Jan 22  2021 arangod.conf.dpkg-old
4 -rw-r--r--   1 root root  1687 Apr 23 13:42 arangod.conf.ipf
4 -rw-r--r--   1 root root  1696 Mar  4 10:44 arangod.conf.ipf-orig

root@IPF:~# lsof -i | grep 8529 | grep LISTEN
arangod    876 arangodb   26u  IPv6  17979      0t0  TCP *:8529 (LISTEN)

After these steps, the GUI should function correctly.

Fortinet NAT44 and Zone Firewall Tasks Causing Discovery Issues

When NAT44 and Zone Firewall tasks are enabled, discovery processes may hang or experience significant delays when handling Fortinet devices. This can result in failed discoveries or cause devices to be missing from snapshots.

Temporarily disabling both NAT44 and Zone firewall discovery tasks for the fortigate Family (in Settings → Discovery & Snapshots → Discovery Settings → Disabled Discovery Tasks) is the recommended hotfix until this issue is resolved in one of the upcoming releases.

Disabled Discovery Tasks

Disable Zone firewall discovery task for FortiGate

Disable NAT44 discovery task for FortiGate

v7.3.15 (July 15th, 2025; GA)

SHA256 (ipfabric-update-7-3-15+0.tar.zst.sig) = a6afc4481406fccf98c3be2d38de6f68a57163a617738a853c31d6789751a0be
MD5 (ipfabric-update-7-3-15+0.tar.zst.sig) = f9cdd873a843d454a886b8c09c6cc90c
SHA256 (ipfabric-7-3-15+0.qcow2) = 2e3e74dfcdf2f920f306246a3f38a65cfb7747f1e0c237445e09b2242bc80796
MD5 (ipfabric-7-3-15+0.qcow2) = 987fa49ef37aea1b8bcf7244e0844e06
SHA256 (ipfabric-7-3-15+0.vmdk) = c86d96aea98408908cd85d8f384fa880fce77374954140e8160df0886cb04f47
MD5 (ipfabric-7-3-15+0.vmdk) = 8d54c547ebdef52734e3c02f866af63b
SHA256 (ipfabric-7-3-15+0.vhdx.zst) = 0947c9315969638a72d3216794162cefd45141f79f914b57420778b162f30458
MD5 (ipfabric-7-3-15+0.vhdx.zst) = 1d97aa55ccaf8220428db53fc63f5767
SHA256 (unsupported-ESXi6.7U2-ipfabric-7-3-15+0.ova) = ac6a51e8c932f55480986c2288128b8d9bd5dd8cb548e569ca0d2b0cb0e9042d
MD5 (unsupported-ESXi6.7U2-ipfabric-7-3-15+0.ova) = 87c26cac2b3bb4cefb39db4c673fe377
SHA256 (unsupported-ESXi7.0-ipfabric-7-3-15+0.ova) = 8825d65c267514d23d0487422755eaeac3c00c8e9b73e393c8148c571111dfac
MD5 (unsupported-ESXi7.0-ipfabric-7-3-15+0.ova) = 6201b0376b498501d1baaabb9095874a
SHA256 (ESXi8.0-ipfabric-7-3-15+0.ova) = 98751363b45423d024259dc476fde8d49cde3d401972d6cccc1484b73206adb2
MD5 (ESXi8.0-ipfabric-7-3-15+0.ova) = a71be7773f4b218d4a1740cc3ba96075

Fixes

Fatal Error While Discovery on PaloAlto

In this release, we resolved an issue where Discovery of PaloAlto devices was failing.

v7.3.14 (July 10th, 2025; EA)

Fixes

Aruba Central AP Discovery

In this release, we reverted the Aruba Central AP discovery logic from version 6.10 due to issues that arose when Central-managed APs functioned as controllers for other APs, rather than operating solely as individual devices.

v7.3.13 (June 30th, 2025; EA)

Fixes

Configuration Management Process Fails to Close SSH Sessions

Since 7.3.13, the Configuration Management process for HPE arubasw devices now properly terminates SSH connections and correctly detects login banners.

v7.3.11 (June 12th, 2025; EA)

IP addresses entered in the Settings UI may not be saved in some cases

When entering IP addresses in the Settings UI, changes will only be saved if you click the Add to list button next to the input field or press the Enter key. Although a red validation message appears below the field, it does not prevent the UI from saving the settings—however, any IP addresses not added to the list will be omitted. This issue affects all input fields that accept IP addresses.

New Features

IPv6 Discovery Support

Extended network discovery capabilities to support IPv6 networks alongside IPv4, ensuring all existing IPv4 functionality remains unaffected.

Backward Compatibility
  • Existing IPv4 discovery workflows continue to function as expected.
  • No changes are required for IPv4-only setups.
API Enhancements
  • The /settings API now accepts and processes IPv6 addresses in:
    • Seed lists
    • Include/Exclude/Whitelist networks
    • Device credentials
    • Custom SSH/Telnet ports
  • Address-type validation ensures that:
    • IPv4 filters apply only to IPv4 addresses
    • IPv6 filters apply only to IPv6 addresses
  • Announcing the deprecation of path-based versioning in the following release. More details can be found on the new Versioning page.
Discovery Configuration Updates
  • Introduced a new task type: NDPv6, available under Global Discovery Tasks settings.
  • IPv6 networks can now be discovered using a combination of:
    • Seed addresses
    • Include/Exclude/Whitelist networks
    • Device credentials

Automated SSO

  • We have developed a new script to simplify the SSO setup process for the IP Fabric application. More details can be found on the Automated Single Sign-On (SSO) page.

Improvements

Technology Tables

New Tables

A new Virtual-wires table has been added under Technology → Interfaces, supporting:

  • Palo Alto PAN-OS
  • Cisco Firepower
  • Fortinet FortiGate / FortiOS
  • Forcepoint NGFW
New Columns

The following tables have been updated with new columns:

  • Inventory → Interfaces table:
    • Last Status Change
  • Inventory → Devices table:
    • Login IPv4
    • Login IPv6
    • Switch stack
  • Technology → Interfaces → Switchport table:
    • Virtual Bridge
  • Technology → Addressing → MAC Table table:
    • Virtual Bridge
  • Management → Discovery History table:
    • Login IPv4
    • Login IPv6
  • Management → Changes table:
    • Login IPv4
    • Login IPv6
  • Management → Changes → Managed IP table:
    • IPv4 Address
    • IPv6 Address
  • Management → Saved config consistency table:
    • Login IPv4
    • Login IPv6
  • Technology → Platforms → Cisco VSS → Chassis table:
    • Switch Priority
  • Technology → Management → Telnet access table:
    • Login IPv4
    • Login IPv6
  • Technology → Management → Logging → Remote table:
    • Host IPv4
    • Host IPv6
    • Src Address IPv4
    • Src Address IPv6
  • Technology → Management → NTP → Sources table:
    • Source IPv4
    • Source IPv6
  • Technology → Management → SNMP → Trap Hosts table:
    • Destination Host IPv4
    • Destination Host IPv6
    • Source IPv4
    • Source IPv6
  • Technology → Security → AAA → Servers table:
    • Server IPv4
    • Server IPv6
    • Source IPv4
    • Source IPv6
  • Discovery Snapshot → Connectivity Report table:
    • IPv4
    • IPv6
Column Updates

The following columns will be change in the next major release (v8.0). Currently this reports only the IPv4 address, but in the next major release, it will report either the IPv4 and IPv6 addresses based on the discovered device’s IP version. This change will change the type of data to a simple text string that does not support CIDR or IP filtering.

The section above shows that new IPv4 and IPv6 columns have been added to the technology tables referenced below. These new columns support full CIDR search capabilities to meet your current and future filtering requirements.

Affected columns:

  • Inventory → Devices → Login IP
  • Management → Discovery History → Login IP
  • Management → Changes → Login IP
  • Management → Changes → Managed IP → IP Address
  • Management → Saved config consistency → Login IP
  • Technology → Management → Telnet access → Login IP
  • Discovery Snapshot → Connectivity Report → IP

After this change if an Intent Rule is using one of these columns it will be automatically exported to a file and the rule will be deleted. We expect that this change does not affect most customers. If you are using these columns please contact your Solution Architect or Support and they can assist you in restoring the rules.

Automation Concerns

Please ensure all scripts, automations, or reports are properly updated to reflect this change.

Deprecated Tables
  • Removed tables of already deprecated API endpoints:
    • Managed Networks
    • Gateway Redundancy

IPv4 Managed IP Summary table

As of version 7.0, the Managed Networks and Gateway Redundancy tables have been replaced by the IPv4 Managed IP Summary table.

GUI

IP Input Enhancement:

  • Search Functionality: Users can perform keyword-based searches within the IP list to quickly locate specific entries.
  • IP List Management: Users can efficiently manage IP addresses through enhanced multi-selection capabilities. Multiple IPs can be selected via:
    • Shift + Left Click to select range.
    • Click-and-Drag, similar to text selection in a paragraph.
    • Once selected, IP addresses can be copied or removed from the list.

Layout Optimization for Large Circular Graphs

In release 7.2, we added an autonomous optimization switch from circular to universal layout for graphs with more than 100 nodes. This functionality is now fully supported at the API level and is also fully integrated into the UI starting with this release.

Configuration Management

  • Simplified configuration selection for comparison.
  • Added a new Compare with previous version button to configuration entries in the table.

Network Discovery

  • New Device – AWS Application Load Balancer (ALB)
    • Initial support for data collection & inventory. The path lookup via ALB is not supported yet.

  • New Device – Azure ExpressRoute Circuit (ERC)

    • Data collection and end-to-end path lookup via ERC is now supported. The path lookup via ERC when deployed in vWAN is not supported yet.

    Do not forget to update IAM policy

    To collect Azure ExpressRoute Circuits, the corresponding IAM policy must be updated. You can download the new policy here.

  • New Device – Azure RouteServer (ARS)
    • Initial support for data collection & inventory - end-to-end path lookup via Network Virtual Appliances has been improved.
  • New Capabilities – Arista
    • Support for route-maps has been added.
  • New Capabilities – CheckPoint, Juniper
    • Support for URL filtering has been added.
  • New Capabilities – PaloAlto (PAN-OS)
    • Support for IP and PREDEFINED-IP type objects of External Dynamic List has been added.
  • New Device – Meraki Cloud-managed Catalyst Switches
    • Now discoverable via the Meraki API
    • Identification: Firmware prefix CS and Monitoring Version (if present) must not be 1 - as 1 indicates the device in monitor-only mode.
    • Discovery can be disabled via feature flags.

Path Lookup

  • Using Palo Alto’s External Dynamic List in combination with end-to-end path lookup:
    • To investigate a Path Lookup scenario for a specific IP expected to be in the dynamic list, use the Source / Destination IP fields and enter the IP address.
    • If the content of the dynamic list is not available, or if you need to find where a specific list is being used, use the Source / Destination Region fields and enter the name of the list as it appears in the configuration.

Vendor Support and Improvements

  • Interface uptime/downtime is now available for Arista located in the new Last Status Change (lastStatusChange) column in the Inventory > Interfaces table.
  • Switch priority is now available for Cisco StackWise located in the new Switch Priority (switchPriority) Technology → Platforms → Cisco VSS → Chassis table.
  • Added IPv6 support for the FortiGate zone firewall task.
  • Added IPv6 support for FortiGate GRE tunnels.
  • Added IPv6 support for the Cisco ACI, ASA, IOS, and IOS-XE NTP task.
  • Added IPv6 support for the Cisco IOS, IOS-XE, and ASA Syslog task.
  • Added IPv6 support for the Cisco IOS, IOS-XE, and ASA AAA task.
  • Added IPv6 support for the Cisco IOS, IOS-XE, and ASA SNMP task.
  • Added IPv6 support for the Cisco ASA Neighbor Discovery task.
  • Added IPv6 support for Cisco ASA IPv6 routing.
  • Added IPv6 support for Cisco ASA IPv6 tunnels.
  • Added IPv6 support for Cisco ASA, IOS, and IOS-XE IPv6 IPsec.
  • New Switch stack column added in Inventory → Devices to show if switch is considered as stack
  • Added ARP table support for Meraki L3 switches.
  • Improved STP support for Meraki switches.

Advanced Filters

Intent Verification Rules

Updated Rules
  • Minor UI updates to remove the Green Success check from empty columns and to revise field descriptions.:
    • Technology > Security > DHCP Snooping
      • DHCP Snooping Enabled VLANs
      • DHCP Snooping Trusted Port
      • DHCP Snooping Dropped Packets
    • Inventory > OS Versions > Platforms
      • Devices with Unique Platform changed to Platforms with a Single Deployment
      • Devices with Unique OS changed to OS Versions with a Single Deployment
    • Inventory > OS Versions > Models
      • Devices with Unique Model changed to Models with a Single Deployment
    • Technology > Management > Port Mirroring > Port Mirroring - Port Mirroring Status
    • Technology > MPLS > L2 VPN > Circuit cross-connect
      • CCC state changed to Circuit Cross-Connect State
    • Technology > SDWAN > Versa > Sites
      • SDWAN Sites Uptime changed to Versa SDWAN Sites Uptime
  • Technology > Spanning Tree > STP Inconsistencies > Neighbor ports allowed VLAN mismatch - Trunk Allowed VLAN Mismatch
    • Removed Green Success check as this rule is not applicable.
  • Technology > FHRP > Group state - FHRP Active Group Priority
    • Adjusted active FHRP groups to include master for support on Aruba and Arista devices.
  • Technology > Platforms > Environment > Power Supplies - Power-Supply State
    • Adjusted Red Error states to include power supplies with a bad state.
  • Technology > Platforms > Environment > Fans - Fan Module State
    • Adjusted Green Success states to include fan modules that contain an ok - state.
  • Inventory > Interfaces - Interface Operational State
    • Green Success - Default which should match normal states.
    • Blue Info - Layer 2 states of unknown (i.e. IP Fabric is unable to discover states on some Meraki devices.)
    • Amber Warning - Interfaces with Layer 1 state matching regex up|enabled and Layer 2 state of down without monitoring status reason.
  • Technology > Addressing > MAC Table > MAC Table - MAC Address Source
    • Green Success - Added igmp to the list of acceptable source types.
    • Blue Info and Amber Warning have been swapped so static MAC address types report as Info instead of Warning.
    • Blue Info - Added svi, permanent, and management to the list of acceptable source types.
New Rules
  • SDWAN Uptime Verifications:
    • Rules:
      • Technology > SDWAN > Silverpeak > Overlay - Silverpeak Overlay Uptime
      • Technology > SDWAN > Viptela > Control Connections - Viptela Control Connections Uptime
      • Technology > SDWAN > VeloCloud > Overlay - VeloCloud Overlay Uptime
    • Green Success - 1 year >= uptime >= 1 week
    • Blue Info - uptime > 1 year
    • Amber Warning - uptime < 1 week
    • Red Error - uptime < 1 day
  • SDWAN Status Verifications:
    • Rules:
      • Technology > SDWAN > Silverpeak > Overlay - Silverpeak Overlay Status
      • Technology > SDWAN > Silverpeak > Underlay - Silverpeak Underlay Status
    • Green Success - Status that is Up Active or Up Idle
    • Blue Info - Status that is Down or other statuses
    • Amber Warning - Status that is Up but with IP SLA Disabled or Reduced Functionality
    • Red Error - Status that is Down and Misconfigured
  • Load Balancing Availability Verifications:
    • Rules:
      • Technology > Load-balancing > Virtual Servers - Load Balancing Virtual Server Availability
      • Technology > Load-balancing > Virtual Servers - Pool members - Load Balancing Pool Member Availability
    • Green Success - Up Availability and Enabled status
    • Blue Info - All other statuses.
    • Amber Warning - Down Availability and Enabled status
  • Technology > Management > AAA > Password Strength - Password Strength Enabled
    • Green Success - Check is enabled on supported platforms
    • Amber Warning - Check is not enabled on supported platforms

Experimental Features

Newly added features which need to be explicitly enabled in service files. You can enable these yourself using our feature documentation or if you are not comfortable self-enabling these features or need further clarification, contact our Support or Solution Architect team. We will gladly help you.

Cisco ACI Service Graphs Improvements

The path lookup capability for Layer 2 (L2) has been added to Cisco ACI Service Graphs.

To collect Service Graph data, the feature flag ENABLE_ACI_SERVICEGRAPHS_ENDPOINTS must be enabled. For more information, see feature flag documentation.

Palo Alto External Dynamic Lists

The ingestion of Palo Alto’s External Dynamic Lists for URL Filtering and IP Lists is currently available as an experimental feature.

To access this functionality, respective feature flags must be enabled. (ENABLE_PALOALTO_EDL_IPLIST and ENABLE_PALOALTO_EDL_URLLIST).

Transparent Firewalls

Initial support for transparent firewalls has been introduced. Since transparent firewalls typically operate at Layer 2 and remain invisible to other network devices, manual link configuration is required to incorporate them into the network model.

To enable this feature, the corresponding feature flag (ENABLE_MANUAL_LINKS) must be activated.

Once enabled, transparent firewalls will appear in the graph topology, and basic path lookup (excluding security policy evaluation) will be supported.

Visualization Setup

In case that you want to edit Manual Link Protocol Settings → Line Cap Label field, it incorrectly permits IP address selection.