API Changes for Network Secure Fabric Link Event Codes
Lets see the API Changes for Network Secure Fabric Link Event Codes in prisma
sd-wan.
The new Secure Fabric Link incident category in 5.4.1 summarizes VPN
incidents between a branch and a data center or between two branches into two groups:
NETWORK_SECUREFABRICLINK_DEGRADED and NETWORK_SECUREFABRICLINK_DOWN.
With this change, the following VPN incidents that identify link connectivity issues are
now grouped into one of the two Secure Fabric Link incidents:
NETWORK_VPNLINK_DOWN
NETWORK_VPNPEER_UNAVAILABLE
NETWORK_VPNSS_UNAVAILABLE
NETWORK_VPNPEER_UNREACHABLE
NETWORK_VPNSS_MISMATCH
NETWORK_VPNBFD_DOWN
And if the root cause for the links connectivity issues is one of the following incident
codes, the Secure Fabric Link incident is suppressed:
DEVICEHW_INTERFACE_DOWN
NETWORK_DIRECTINTERNET_DOWN
NETWORK_DIRECTPRIVATE_DOWN
To view the suppressed incidents, you must use the two new filters for Include Suppressed
and Show Only Suppressed in the incident management window.
The API response highlights the new attributes in the 5.4.1 event structure:
entity_ref for NETWORK_ANYNETLINK_DOWN incidents will now point to anynetlinks
instead of pointing to the site.
info attribute for NETWORK_ANYNETLINK_DOWN will contain a list of VPN IDs.
suppressed_info includes event IDs only if suppressed is True. With the list of
relevant event IDs that are suppressed, the suppressed_time timestamp is added.
(Note: other_reason and rule_id are intended for future use).
notes to add remarks/comments to events. You can edit notes for active incidents
only.
When querying for events using the API, replace the code for:
NETWORK_SECUREFABRICLINK_DOWN with NETWORK_ANYNETLINK_DOWN
NETWORK_SECUREFABRICLINK_DEGRADED with NETWORK_ANYNETLINK_DEGRADED
