General

This bug was found by a customer, so it needs to be published.

Symptom

After the upgrade, the PBR becomes inactive.

Conditions

- The customer is using pbr on N9K with 10.4(2) - After upgrade, pbr does not work. - `show ip policy vrf all` shows pbr as inactive. Interface Route-map Status VRF-Name Vlan100 Temp-Test-PBR Inactive -- - rpm output following log %RPM-2-PPF_SES_VERIFY: rpm [9135] PPF session verify failed in client npacl(Line card 64/VDC 1/UUID 725) with an error 0xffffffff(Device Name:[0x3FF] Instance:[63] Error Type:[(null)] code:[255])

Workaround

Scenario 1: Before upgrade 1. Before upgrade, disable acllog (no logging ip access-list detailed). This will help PBR to avoid NPACL client verification step. 2. Perform upgrade. Now all PBR policy should be active post upgrade. 3. Then enable acllog again (logging ip access-list detailed) Scenario 2: Recovering PBR policy on already upgraded node 1. Disable acllog (no logging ip access-list detailed) 2. Remove and re-add affected PBR policy on SVI interface and make sure PBR policy is active post that operation. 3. Then enable acllog again (logging ip access-list detailed)

Further Problem Description