{"record":{"id":"59a0a73197c8828f","repo":"BerriAI/litellm","slug":"cisco-ai-defense-surface-api-request-failed-ex","errorCode":null,"errorMessage":"Cisco AI Defense {surface} API request failed: {exc}","messagePattern":"Cisco AI Defense (.+?) API request failed: (.+?)","errorType":"exception","errorClass":"CiscoAIDefenseGuardrailAPIError","httpStatus":null,"severity":"error","filePath":"litellm/proxy/guardrails/guardrail_hooks/cisco_ai_defense/cisco_ai_defense.py","lineNumber":838,"sourceCode":"                follow_redirects=False,\n            )\n            response.raise_for_status()\n        except httpx.HTTPStatusError as exc:\n            status_code: Final = exc.response.status_code if exc.response is not None else 0\n            body_snippet = \"\"\n            try:\n                body_snippet = exc.response.text[:500] if exc.response else \"\"\n            except Exception:\n                body_snippet = \"\"\n            raise CiscoAIDefenseGuardrailAPIError(\n                f\"Cisco AI Defense {surface} API returned HTTP {status_code}: {body_snippet}\"\n            ) from exc\n        except httpx.TimeoutException as exc:\n            raise CiscoAIDefenseGuardrailAPIError(\n                f\"Cisco AI Defense {surface} API call timed out after {self.timeout}s\"\n            ) from exc\n        except httpx.RequestError as exc:\n            raise CiscoAIDefenseGuardrailAPIError(f\"Cisco AI Defense {surface} API request failed: {exc}\") from exc\n\n        try:\n            return response.json()\n        except ValueError as exc:\n            raise CiscoAIDefenseGuardrailAPIError(\n                f\"Cisco AI Defense {surface} API returned a non-JSON response\"\n            ) from exc\n\n    def _build_headers(self) -> dict[str, str]:\n        return {\n            CISCO_API_KEY_HEADER: self.api_key,\n            \"Content-Type\": \"application/json\",\n            \"Accept\": \"application/json\",\n            \"User-Agent\": f\"litellm/{litellm_version}\",\n        }\n\n    def _build_metadata(\n        self,","sourceCodeStart":820,"sourceCodeEnd":856,"githubUrl":"https://github.com/BerriAI/litellm/blob/77b7c6c40c0c5aa5fbcb1d6a1825ac39ca8829b8/litellm/proxy/guardrails/guardrail_hooks/cisco_ai_defense/cisco_ai_defense.py#L820-L856","documentation":"CiscoAIDefenseGuardrailAPIError raised when httpx raises a RequestError that is not a timeout — connection refused/reset, DNS resolution failure, TLS certificate error, or proxy negotiation failure while reaching the Cisco AI Defense API base. The underlying exception text ({exc}) names the exact network fault, and it is chained as __cause__.","triggerScenarios":"Inspect calls failing before any HTTP status exists: wrong CISCO_AI_DEFENSE_API_BASE hostname (NXDOMAIN), firewall/egress rules blocking the Cisco domain, corporate MITM proxy with an untrusted CA, TLS mismatches, or connection resets during network flaps.","commonSituations":"Containers without corporate CA bundles failing TLS to TLS-intercepting proxies; staging environments with no outbound internet; api_base typos (cisco.example vs real host); Kubernetes NetworkPolicies blocking egress; transient DNS failures in large deployments.","solutions":["Test raw reachability from the proxy host: curl -v $CISCO_AI_DEFENSE_API_BASE — fix DNS/firewall/egress based on the failure mode.","If behind a TLS-intercepting proxy, mount the corporate CA or configure httpx SSL context appropriately.","Fix or unset a wrong CISCO_AI_DEFENSE_API_BASE so the default official endpoint is used.","Set fallback_on_error: allow to keep traffic flowing (unscanned, logged) when the inspection endpoint is unreachable."],"exampleFix":"# before — unreachable Cisco endpoint breaks all LLM calls\nlitellm_params:\n  guardrail: cisco_ai_defense\n\n# after — proceed unscanned when the guardrail network path fails\nlitellm_params:\n  guardrail: cisco_ai_defense\n  fallback_on_error: allow","handlingStrategy":"retry","validationCode":"import httpx, os\nbase = os.environ.get(\"CISCO_AI_DEFENSE_API_BASE\") or \"<default>\"\ntry:\n    httpx.get(base, timeout=5)\nexcept httpx.ConnectError as e:\n    raise SystemExit(f\"Cisco endpoint unreachable from this host: {e}\")\nexcept httpx.ConnectTimeout:\n    raise SystemExit(\"Cisco endpoint connect timeout — check egress/firewall\")","typeGuard":null,"tryCatchPattern":"try:\n    resp = litellm.completion(...)\nexcept Exception as e:\n    cause = getattr(e, \"__cause__\", None)\n    if isinstance(cause, httpx.ConnectError):\n        log_network_issue(cause); retry_once_later()  # transient reset/DNS\n    elif isinstance(cause, httpx.ConnectTimeout):\n        alert_egress_blocked()\n    raise","preventionTips":["Run a connectivity smoke test from the exact proxy runtime (container, not dev laptop) before enabling.","Whitelist Cisco domains in egress firewalls / NetworkPolicies explicitly.","Mount corporate CA bundles into containers when TLS-intercepting proxies are in path.","fallback_on_error: allow decouples LLM availability from scanner network health."],"tags":["litellm","guardrails","cisco-ai-defense","connection-error","dns","tls","network"],"backgroundTag":"connection-failed","analyzedSha":"77b7c6c40c0c5aa5fbcb1d6a1825ac39ca8829b8","analyzedAt":"2026-08-18T11:44:31.656Z","schemaVersion":2},"datasetVersion":"2026-08-21T23:17:16.201Z"}