: API Changes for Network Secure Fabric Link Event Codes
Focus
Focus

API Changes for Network Secure Fabric Link Event Codes

Table of Contents

API Changes for Network Secure Fabric Link Event Codes

The new Secure Fabric Link alarm category in 5.4.1 summarizes VPN alarms between a branch and a data center or between two branches into two groups-NETWORK_SECUREFABRICLINK_DEGRADED and NETWORK_SECUREFABRICLINK_DOWN.
With this change, the following VPN alarms that identify link connectivity issues are now grouped into one of the two Secure Fabric Link alarms:
  • NETWORK_VPNLINK_DOWN
  • NETWORK_VPNPEER_UNAVAILABLE
  • NETWORK_VPNSS_UNAVAILABLE
  • NETWORK_VPNPEER_UNREACHABLE
  • NETWORK_VPNSS_MISMATCH
  • NETWORK_VPNBFD_DOWN
And if the root cause for the links connectivity issues is one of the following alarm codes, the Secure Fabric Link alarm is suppressed:
  • DEVICEHW_INTERFACE_DOWN
  • NETWORK_DIRECTINTERNET_DOWN
  • NETWORK_DIRECTPRIVATE_DOWN
To view the suppressed alarms, you must use the two new filters for Include Suppressed and Show Only Suppressed in the alarm management window.
The following is a sample API response.
Before Version 5.4.1Starting Version 5.4.1
{"_created_on_utc": "2020-07-21T19:09:13.454000Z", "_etag": 1, "_updated_on_utc": "2020-07-21T19:09:13.454000Z", "acknowledged": False, "acknowledgement_info": None, "cleared": False, "code": "NETWORK_VPNLINK_DOWN", "correlation_id": "NW6JYud4", "element_id": "14999711939070152", "entity_ref": "tenants/1092/sites/14994575835930104", "id": "5f173d59d7b0fa339626dc98", "info":{ "al_id": "15809335672920128", "vpn_link_id": "15953585219130188" }, "severity": "major", "site_id": "14994575835930104", "time": "2020-07-21T19:09:12.346000Z", "type": "alarm"{ "info": { "vpnlinks": [ "15821811883320202" ] }, "acknowledgement_info": None, "type": "alarm", "severity": "major", "_updated_on_utc": "2020-06-02T20:27:16.855000Z", "site_id": "14764819359580119", "notes": "Test Notes", "acknowledged": False, "cleared": False, "id": "5ed593d2a09dee5049286694", "entity_ref": "tenants/1092/anynetlinks/15507065212560023", "correlation_id": "h76a6B6X", "code": "NETWORK_ANYNETLINK_DOWN", "suppressed_info": { "event_ids": [ "5ed593d1a09dee5049286689", "5ed593d2a09dee5049286692", "5ed6b624a09dee58c781256b" ], "other_reason": None, "suppressed_time": "2020-06-02T20:27:16.855000Z", "rule_id": None }, "time": "2020-06-01T23:48:34.353000Z", "element_id": None, "_created_on_utc": "2020-06-01T23:48:34.379000Z", "suppressed": True, "_etag": 4}
The API response highlights the new attributes in the 5.4.1 event structure:
  • entity_ref for NETWORK_ANYNETLINK_DOWN alarms will now point to anynetlinks instead of pointing to the site.
  • info attribute for NETWORK_ANYNETLINK_DOWN will contain a list of VPN IDs.
  • suppressed_info includes event IDs only if suppressed is True. With the list of relevant event IDs that are suppressed, the suppressed_time timestamp is added. (Note: other_reason and rule_id are intended for future use).
  • notes to add remarks/comments to events. You can edit notes for active alarms only.
When querying for events using the API, replace the code for:
  • NETWORK_SECUREFABRICLINK_DOWN with NETWORK_ANYNETLINK_DOWN
  • NETWORK_SECUREFABRICLINK_DEGRADED with NETWORK_ANYNETLINK_DEGRADED
For example: { "limit":{ "count":100, "sort_on":"time", "sort_order":"descending" }, "severity":[], "acknowledged":False, "start_time":None, "query":{ "site":[], "category":[], "code":["NETWORK_ANYNETLINK_DOWN"], "correlation_id":[], "type":["alarm"] }}