Known Issues

This section lists known issues for the Cloud CPE Solution Release 2.1.1.

• When you deploy a microservice directly on a server, you might not be able to ping infrastructure service IP addresses from inside Kubernetes pods.

  Workaround: Execute the following commands to resolve the issue:

  1. Clear the post-routing rules in iptables:
     root@host:~/# for i in $( iptables -t nat --line-numbers -L | grep ^[0-9] | awk '{ print $1 }' | tac ); do iptables -t nat -D POSTROUTING $i; done
  2. Restart the flanneld service.
     root@host:~/# service flanneld restart

  [CD-729]

• Administration Portal might take a short while to update data fields after you delete objects.

  [CXU-1806]

• Some notifications about the success or failure of create and delete operations in Administration Portal are difficult to understand.

  Workaround: Monitor the create, update, or delete status of the object in the object table.

  [CXU-2364]

• If a VNF fails, there might be a short delay before the recovery process begins.

  Workaround: Monitor the recovery process to ensure that the VNF restarts after a short while.

  [CXU-2836]

• You cannot add a firewall rule for the UTM function in a network service that uses the vSRX VNF.

  [CXU-2846]

• The network service recovery process might fail because Contrail Service Orchestration cannot retrieve the configuration settings for the VNF.

  Workaround: Terminate the VNF process and restart the VNF from the command line.

  [CXU-2860]

• Connectivity between the regional microservices server and a CPE device might fail with a timeout error.

  Workaround: None

  [CXU-2995]

• Installation of more than 300 licenses might fail with a timeout error.

  Workaround: Repeat the installation.

  [CXU-3663]

• After you activate an SRX Series Services Gateway in Customer Portal and then deactivate it, the GUI might still show the status of the device as Activating on the Monitor page.

  Workaround: Refresh the Monitor page in Customer Portal.

  [CXU-3750]

• Deactivating an SRX Series Services Gateway acting as a CPE device might not remove all configuration settings from the device.

  Workaround: Manually delete the configuration settings from the SRX Series Services Gateway.

  [CXU-3754]

• You cannot deploy two network services simultaneously on a CPE device in Customer Portal.

  Workaround: Deploy only one network service on a CPE device.

  [CXU-3756]

• The device profile srx-deployment-option-1 assigns OAM traffic to the fxp0 interface, which is not available on the SRX Series Services Gateway.

  Workaround: Edit the stage 1 configuration for the CPE device in Customer Portal to use an interface other than fxp0 for OAM traffic. [CXU-3779]

• Logs for CPE devices in Customer Portal do not specify whether or not the deployment of a VNF is successful.

  Workaround: None

  [CXU-3802]

• The traffic rate value does not change when you monitor a service on an SRX Series Services Gateway in Customer Portal.

  Workaround: None

  [CXU-3822]

• If you create multiple rules for APBR and then delete them, Customer Portal still displays the first rule that you configured.

  Workaround: Click OK to close the page, then reopen it. The first rule that you created is no longer visible.

  [CXU-3831]

• You can only create a single on-premise site for a tenant in Administration Portal if the WAN-0 and WAN-1 ports on the CPE device are ge-0/0/0 and ge-0/0/1 for an SRX Series Services Gateway or vSRX implementation, or ge-0/0/10 and ge-0/0/11 for an NFX250 device.

  Workaround: For an SRX Series Services Gateway or vSRX implementation acting as a CPE device, use the Import Tenant option to import the tenant and site data or use the API to set up the site. There is no workaround for an NFX250 CPE device.

  [CXU-3838]

• When you configure an on-premise site for an SD-WAN topology, you must provide an IP prefix and default gateway for the device, although Contrail Service Orchestration does not use the values.

  Workaround: Enter any valid values in the fields if you want to use Administration Portal to configure the sites. Otherwise, either use the Import Tenant option to import the tenant and site data or use the API to set up the site.

  [CXU-3839], [CXU-4560]

• You can only create a single on-premise site for a tenant in Administration Portal if the WAN-0 and WAN-1 ports on the CPE device are ge-0/0/0 and ge-0/0/1 for an SRX Series Services Gateway or vSRX implementation, or ge-0/0/10 and ge-0/0/11 for an NFX250 device.

  Workaround: Use the Import Tenant option or the API to edit the configuration for the correct interfaces and to create the sites.

  [CXU-3840]

• The NFX250 device does not receive communications to block unicast reverse path forwarding (uRPF) because two interfaces on the NFX250 device communicate separately with one interface on the regional microservices server.

  Workaround: Disable the uRPF check in JDM on all interfaces for each NFX Series device.

  [CXU-3854]

• When you log into Kibana for the first time, you might see an error.

  Workaround: Click Settings to refresh the page.

  [CXU-3875]

• When you deactivate an NFX250 device by deleting the CPE device from the list of active devices, the operation might fail.

  Workaround: None

  [CXU-3880]

• You cannot monitor an SD-WAN network service on a CPE device through Customer Portal.

  Workaround: Use the Service and Infrastructure Monitor page to monitor the service.

  [CXU-3881]

• You must use a different router for a PE in a distributed deployment and an SDN gateway in a centralized deployment. You cannot use the same router for both of these functions.

  Workaround: None

  [CXU-4173]

• You must configure the VLAN settings for an NFX250 device before you configure the Silver Peak VX VNF in Customer Portal.

  [CXU-4402]

• An end user cannot change the password for Customer Portal if the current password is not available.

  Workaround: Delete and re-create the customer with Administration Portal or the API.

  [CXU-4537]

• You cannot edit the settings for a customer in Administration Portal.

  Workaround: Edit the customer settings in the JSON file. [CXU-4538]

• You can only view one network service at a time on a CPE device in Customer Portal.

  [CXU-4551]

• When you configure the MX Series router as an IPsec concentrator in a distributed deployment, you must specify the Internet Gateway of the IPsec concentrator in the default routing instance. Otherwise, the IPsec tunnel is not established.

  [CXU-4566]

• You must specify a target URL when you select http-get for the probe type when you configure IP monitoring for a CPE device. Otherwise, the configuration fails.

  [CXU-4571]

• if you use the device template NFX_deployment_option_4 on the NFX250 device, the customer cannot deploy the Silver Peak VX VNF through Customer Portal on that NFX250 device.

  Workaround: Use API calls to deploy the Silver Peak VX VNF on a device.

  [CXU-4585]