API Changes for Network Secure Fabric Link Event Codes

The new Secure Fabric Link alarm category in 5.4.1 summarizes VPN alarms between a branch and a data center or between two branches into two groups-NETWORK_SECUREFABRICLINK_DEGRADED and NETWORK_SECUREFABRICLINK_DOWN.
With this change, the following VPN alarms that identify link connectivity issues are now grouped into one of the two Secure Fabric Link alarms:
  • NETWORK_VPNLINK_DOWN
  • NETWORK_VPNPEER_UNAVAILABLE
  • NETWORK_VPNSS_UNAVAILABLE
  • NETWORK_VPNPEER_UNREACHABLE
  • NETWORK_VPNSS_MISMATCH
  • NETWORK_VPNBFD_DOWN
And if the root cause for the links connectivity issues is one of the following alarm codes, the Secure Fabric Link alarm is suppressed:
  • DEVICEHW_INTERFACE_DOWN
  • NETWORK_DIRECTINTERNET_DOWN
  • NETWORK_DIRECTPRIVATE_DOWN
To view the suppressed alarms, you must use the two new filters for Include Suppressed and Show Only Suppressed in the alarm management window.
The following is a sample API response.
Before Version 5.4.1
Starting Version 5.4.1
{"_created_on_utc": "2020-07-21T19:09:13.454000Z", "_etag": 1, "_updated_on_utc": "2020-07-21T19:09:13.454000Z", "acknowledged": False, "acknowledgement_info": None, "cleared": False, "code": "NETWORK_VPNLINK_DOWN", "correlation_id": "NW6JYud4", "element_id": "14999711939070152", "entity_ref": "tenants/1092/sites/14994575835930104", "id": "5f173d59d7b0fa339626dc98", "info":{ "al_id": "15809335672920128", "vpn_link_id": "15953585219130188" }, "severity": "major", "site_id": "14994575835930104", "time": "2020-07-21T19:09:12.346000Z", "type": "alarm"
{ "info": { "vpnlinks": [ "15821811883320202" ] }, "acknowledgement_info": None, "type": "alarm", "severity": "major", "_updated_on_utc": "2020-06-02T20:27:16.855000Z", "site_id": "14764819359580119", "notes": "Test Notes", "acknowledged": False, "cleared": False, "id": "5ed593d2a09dee5049286694", "entity_ref": "tenants/1092/anynetlinks/15507065212560023", "correlation_id": "h76a6B6X", "code": "NETWORK_ANYNETLINK_DOWN", "suppressed_info": { "event_ids": [ "5ed593d1a09dee5049286689", "5ed593d2a09dee5049286692", "5ed6b624a09dee58c781256b" ], "other_reason": None, "suppressed_time": "2020-06-02T20:27:16.855000Z", "rule_id": None }, "time": "2020-06-01T23:48:34.353000Z", "element_id": None, "_created_on_utc": "2020-06-01T23:48:34.379000Z", "suppressed": True, "_etag": 4}
The API response highlights the new attributes in the 5.4.1 event structure:
  • entity_ref for NETWORK_ANYNETLINK_DOWN alarms will now point to anynetlinks instead of pointing to the site.
  • info attribute for NETWORK_ANYNETLINK_DOWN will contain a list of VPN IDs.
  • suppressed_info includes event IDs only if suppressed is True. With the list of relevant event IDs that are suppressed, the suppressed_time timestamp is added. (Note: other_reason and rule_id are intended for future use).
  • notes to add remarks/comments to events. You can edit notes for active alarms only.
When querying for events using the API, replace the code for:
  • NETWORK_SECUREFABRICLINK_DOWN with NETWORK_ANYNETLINK_DOWN
  • NETWORK_SECUREFABRICLINK_DEGRADED with NETWORK_ANYNETLINK_DEGRADED
For example: { "limit":{ "count":100, "sort_on":"time", "sort_order":"descending" }, "severity":[], "acknowledged":False, "start_time":None, "query":{ "site":[], "category":[], "code":["NETWORK_ANYNETLINK_DOWN"], "correlation_id":[], "type":["alarm"] }}

Recommended For You