API Changes for Network Secure Fabric Link Event Codes
Table of Contents
Expand All
|
Collapse All
Prisma SD-WAN Docs
-
-
-
-
- AWS Transit Gateway
- Azure vWAN
- Azure vWAN with vION
- ChatBot for MS Teams
- ChatBot for Slack
- CloudBlades Integration with Prisma Access
- GCP NCC
- Service Now
- Zoom QSS
- Zscaler Internet Access
-
-
- ION 5.2
- ION 5.3
- ION 5.4
- ION 5.5
- ION 5.6
- ION 6.0
- ION 6.1
- ION 6.2
- ION 6.3
- ION 6.4
- New Features Guide
- On-Premises Controller
- Prisma Access CloudBlade Cloud Managed
- Prisma Access CloudBlade Panorama Managed
- Prisma SD-WAN CloudBlades
API Changes for Network Secure Fabric Link Event Codes
The new Secure Fabric Link alarm category
in 5.4.1 summarizes VPN alarms between a branch and a data center
or between two branches into two groups-NETWORK_SECUREFABRICLINK_DEGRADED
and NETWORK_SECUREFABRICLINK_DOWN.
With this change, the following VPN alarms that identify link
connectivity issues are now grouped into one of the two Secure Fabric Link
alarms:
- NETWORK_VPNLINK_DOWN
- NETWORK_VPNPEER_UNAVAILABLE
- NETWORK_VPNSS_UNAVAILABLE
- NETWORK_VPNPEER_UNREACHABLE
- NETWORK_VPNSS_MISMATCH
- NETWORK_VPNBFD_DOWN
And if the root cause for the links connectivity issues is one
of the following alarm codes, the Secure Fabric Link alarm is suppressed:
- DEVICEHW_INTERFACE_DOWN
- NETWORK_DIRECTINTERNET_DOWN
- NETWORK_DIRECTPRIVATE_DOWN
To view the suppressed alarms, you must use the two new filters
for Include Suppressed and Show Only Suppressed in the alarm management
window.
The following is a sample API response.
| Before Version 5.4.1 | Starting Version 5.4.1 |
|---|---|
| {"_created_on_utc": "2020-07-21T19:09:13.454000Z", "_etag": 1, "_updated_on_utc": "2020-07-21T19:09:13.454000Z", "acknowledged": False, "acknowledgement_info": None, "cleared": False, "code": "NETWORK_VPNLINK_DOWN", "correlation_id": "NW6JYud4", "element_id": "14999711939070152", "entity_ref": "tenants/1092/sites/14994575835930104", "id": "5f173d59d7b0fa339626dc98", "info":{ "al_id": "15809335672920128", "vpn_link_id": "15953585219130188" }, "severity": "major", "site_id": "14994575835930104", "time": "2020-07-21T19:09:12.346000Z", "type": "alarm" | { "info": { "vpnlinks": [ "15821811883320202" ] }, "acknowledgement_info": None, "type": "alarm", "severity": "major", "_updated_on_utc": "2020-06-02T20:27:16.855000Z", "site_id": "14764819359580119", "notes": "Test Notes", "acknowledged": False, "cleared": False, "id": "5ed593d2a09dee5049286694", "entity_ref": "tenants/1092/anynetlinks/15507065212560023", "correlation_id": "h76a6B6X", "code": "NETWORK_ANYNETLINK_DOWN", "suppressed_info": { "event_ids": [ "5ed593d1a09dee5049286689", "5ed593d2a09dee5049286692", "5ed6b624a09dee58c781256b" ], "other_reason": None, "suppressed_time": "2020-06-02T20:27:16.855000Z", "rule_id": None }, "time": "2020-06-01T23:48:34.353000Z", "element_id": None, "_created_on_utc": "2020-06-01T23:48:34.379000Z", "suppressed": True, "_etag": 4} |
The API response highlights the new attributes in the 5.4.1
event structure:
- entity_ref for NETWORK_ANYNETLINK_DOWN alarms will now point to anynetlinks instead of pointing to the site.
- info attribute for NETWORK_ANYNETLINK_DOWN will contain a list of VPN IDs.
- suppressed_info includes event IDs only if suppressed is True. With the list of relevant event IDs that are suppressed, the suppressed_time timestamp is added. (Note: other_reason and rule_id are intended for future use).
- notes to add remarks/comments to events. You can edit notes for active alarms only.
When querying for events using the API, replace the code for:
- NETWORK_SECUREFABRICLINK_DOWN with NETWORK_ANYNETLINK_DOWN
- NETWORK_SECUREFABRICLINK_DEGRADED with NETWORK_ANYNETLINK_DEGRADED