Troubleshoot a spine-and-leaf datacenter network scenario involving servers and firewalls. Using the supplied network observations, identify servers with a missing, unknown, or non-operational leaf link, or with a denied required flow. Treat the highest-priority enabled matching firewall rule as authoritative; if no rule matches, treat the flow as denied.
Output
- One row per affected server with
hostname, leaf_device, link_status, blocked_flows, and diagnosis.
- Include only affected servers, ordered by incident severity descending, then hostname ascending.
Output details
- Use the latest link observation per server, breaking timestamp ties by descending
link_id.
- Use the latest flow observation per server, destination zone, and destination port, breaking timestamp ties by descending
flow_id.
- Break equal-priority matching enabled rules by ascending
rule_id, placing NULL priorities and rule IDs last.
- Treat a link status of NULL or anything other than
UP as non-operational, while preserving NULL link_status values.
- Render a missing device as
UNCONNECTED, count denied latest flows including unmatched flows, and use 0 when no flows exist.
- Use
LINK_MISSING, PATH_DOWN_AND_FIREWALL_DENY, LINK_NOT_OPERATIONAL, and FIREWALL_DENY; assign severities 3, 2, 2, and 1, respectively, and retain duplicate server records.
