CLI での確認方法

DCNhowtoAdmin · ‎2021-09-24

ACIの設定や状態の実体はAPICやノード（スイッチ）に存在しますが、その構造はMIT（Management Information Tree)とよばれ、ツリー型の構造化されたObjectベースの設定ファイルとなっています。

通常管理者はAPICの管理GUIから設定を行いますが、それ以外にもREST APIや、CLI経由で直接このデータ構造にアクセスすることも可能です。

ここではCLIでのアクセス方法を紹介します。

本ページの他にも以下が参考になるので、参照ください。

APICへのCLIアクセス

APICの管理IPのアドレスへSSHでアクセスすることでAPIC CLIへのアクセスが可能です。

$ ssh admin@172.16.10.1

Application Policy Infrastructure Controller

admin@172.16.10.1's password:

Last login: Wed Feb 25 15:49:13 2015 from 172.16.254.57

admin@apic1:~>

$ ssh admin@172.16.10.1

Application Policy Infrastructure Controller

admin@172.16.10.1's password:

Last login: Wed Feb 25 15:49:13 2015 from 172.16.254.57

admin@apic1:~>

もしくはAPIC GUIからBrowse経由でのSSHも可能です。

Linux BashでAPICのMITへアクセスすることが可能です。

moを直接vimで編集することも可能です。

admin@apic1:~> pwd

/home/admin

admin@apic1:~>

admin@apic1:~> ls

aci debug mit moquery ntpstat

admin@apic1:~>

admin@apic1:~> cd aci

admin@apic1:aci>

admin@apic1:aci> ls

admin fabric l4-l7-services system tenants vm-networking

admin@apic1:aci>

admin@apic1:aci> cd tenants/

admin@apic1:tenants> ls

L2Tra T3 OpenStack_test1 T4 common tenant.wiz

T1 T5 infra T2 T6 Tennant1 mgmt

admin@apic1:tenants>

admin@apic1:tenants> cd Tennant1/

admin@apic1:Tennant1>

admin@apic1:Tennant1> ls

application-profiles monitoring-policies summary

controller-management-policies networking tags

l4-l7-service-parameters operational troubleshoot-policies

l4-l7-services security-domains

mo security-policies

admin@apic1:Tennant1>

admin@apic1:Tennant1> cat summary

# tenant

name : Tennant1

description :

ownerkey :

ownertag :

monitoring-policy :

security-domains:

name description

---- -----------

tags:

name

----

admin@apic1:Tennant1> vim mo

# tenant

# Naming properties (DO NOT EDIT):

# name : Tennant1

# Configurable Properties:

description :

ownerkey :

ownertag :

monitoring-policy :

mobrowserと入力するとMOをTree形式で参照することも可能です。

admin@apic1:~> mobrowser

SwtichへのCLIアクセス

Switchへ設定したOOB管理IPアドレスに対してSSHでアクセスします。

管理IPアドレスの設定方法についてはこちらを参照下さい。

ssh admin@172.16.10.201

Nexus 9000 Switch

Password:

Cisco Nexus Operating System (NX-OS) Software

TAC support: http://www.cisco.com/tac

The copyrights to certain works contained in this software are

owned by other third parties and used and distributed under

license. Certain components of this software are licensed under

the GNU General Public License (GPL) version 2.0 or the GNU

Lesser General Public License (LGPL) Version 2.1. A copy of each

such license is available at

http://www.opensource.org/licenses/gpl-2.0.php and

http://www.opensource.org/licenses/lgpl-2.1.php

Spine1#

APIC同様のAPIC GUIからBrowser経由でのアクセスも可能です。

Leaf1# show vlan

VLAN Name Status Ports

---- -------------------------------- --------- -------------------------------

13 -- active Eth1/1, Eth1/2, Eth1/3

17 tsetaka-test02:BD2 active Eth1/43

18 Tennant1:BD1 active Eth1/5, Eth1/43

19 Tennant1:3TierApp:Web active Eth1/5

22 -- active Eth1/10

23 -- active Eth1/7

24 T3:BD2 active Eth1/12, Eth1/43

26 L2Tra:BD2 active Eth1/6

27 L2Tra:L2Tra:EPGB active Eth1/6

28 L2Tra:BD1 active Eth1/6, Eth1/43

29 L2Tra:L2Tra:EPGA active Eth1/6

30 T1:BD1 active Eth1/43

31 tsetaka-test02:BD1 active Eth1/43

32 Tennant1:3TierApp:Web active Eth1/43

33 T6:BD1 active Eth1/43

34 T6:ANP:EPG2 active Eth1/43

35 T2:anp1:epg2 active Eth1/43

36 tsetaka-test02:ANP:EPG1 active Eth1/43

37 -- active Eth1/7

38 T2:anp1:epg1 active Eth1/43

39 tsetaka-test02:ANP:EPG2 active Eth1/43

40 T4:multiexit:epg1 active Eth1/43

41 T2:bd2 active Eth1/43

42 T6:ANP:EPG1 active Eth1/43

43 T2:bd1 active Eth1/43

45 T4:BD1 active Eth1/43

46 T4:multiexit:epg2 active Eth1/43

47 T4:BD2 active Eth1/43

48 L2Tra:L2Tra:EPGA active Eth1/43

49 T6:BD2 active Eth1/43

50 T3:test:INT_SERVER active Eth1/43

51 takfujii:NEC active Eth1/43

52 T1:test:EXT_SERVER active Eth1/43

53 -- active Eth1/7

63 T3:bigipctxnone:internal: active Eth1/12

64 T3:bigipctxnone:external: active Eth1/11

69 T3:BD1 active Eth1/11

VLAN Type Vlan-mode

Leaf1# show endpoint vrf T6:C1

Legend:

O - peer-attached H - vtep a - locally-aged S - static

V - vpc-attached p - peer-aged L - local M - span

s - static-arp B - bounce

+---------------+---------------+-----------------+--------------+-------------+

VLAN/ Encap MAC Address MAC Info/ Interface

Domain VLAN IP Address IP Info

+---------------+---------------+-----------------+--------------+-------------+

T6:C1 101.1.1.1 L

T6:C1 192.168.2.2

T6:C1 192.168.1.2

33/T6:C1 vxlan-16318375 0050.56a9.e84b tunnel11

42 vlan-2038 0050.56a9.3eb6 L eth1/43

T6:C1 vlan-2038 192.168.1.1 L

49/T6:C1 vxlan-16351142 0050.56a9.8666 tunnel11

34 vlan-2040 0050.56a9.1608 L eth1/43

T6:C1 vlan-2040 192.168.2.1 L

53/T6:C1 vxlan-15171527 547f.ee2b.b481 L eth1/7

+------------------------------------------------------------------------------+

Endpoint Summary

+------------------------------------------------------------------------------+

Total number of Local Endpoints : 4

Total number of Remote Endpoints : 4

Total number of Peer Endpoints : 0

Total number of vPC Endpoints : 0

Total number of non-vPC Endpoints : 4

Total number of MACs : 5

Total number of VTEPs : 0

Total number of Local IPs : 5

Total number of Remote IPs : 2

Total number All EPs : 8

Leaf1#

Leaf1# vsh

(NX-OS Likeなシェルへ入ることも可能）

Cisco NX-OS Software

NX-OS/Titanium software ("NX-OS/Titanium Software") and related

documentation, files or other reference materials ("Documentation")

are the proprietary property and confidential information of Cisco

Systems, Inc. ("Cisco") and are protected, without limitation,

pursuant to United States and International copyright and trademark

laws in the applicable jurisdiction which provide civil and criminal

penalties for copying or distribution without Cisco's authorization.

The use of NX-OS/Titanium Software and Documentation is strictly

limited to Cisco's internal use.

Any use or disclosure, in whole or in part, of the NX-OS/Titanium

Software or Documentation to any third party for any purposes is

expressly prohibited except as otherwise authorized by Cisco in writing.

The copyrights to certain works contained herein are owned by other

third parties and are used and distributed under license. Some parts

of this software may be covered under the GNU Public License or the

GNU Lesser General Public License. A copy of each such license is

available at

http://www.gnu.org/licenses/gpl.html and

http://www.gnu.org/licenses/lgpl.html

`terminal color`

Leaf1#

Leaf1# show vrf

各テナントのPrivate NetworkがVRFとしてSwitchに展開されていることを確認

VRF-Name VRF-ID State Reason

L2Tra:PN 7 Up --

T1:VRF1 25 Up --

T2:C1 5 Up --

T3:VRF1 17 Up --

T3:VRF2 6 Up --

T4:C1 8 Up --

T4:C2 9 Up --

T6:C1 15 Up --

Tennant1:PN 4 Up --

black-hole 3 Up --

common:default 14 Up --

management 2 Up --

overlay-1 18 Up --

Leaf1#

Leaf1# sh ip route vrf T6:C1

テナント内のルーティングテーブルの状態を確認

IP Route Table for VRF "T6:C1"

'*' denotes best ucast next-hop

'**' denotes best mcast next-hop

'[x/y]' denotes [preference/metric]

'%<string>' in via output denotes VRF <string>

0.0.0.0/0, ubest/mbest: 1/0

*via 172.16.1.254, Vlan53, [1/0], 1d17h, static

101.1.1.1/32, ubest/mbest: 2/0, attached, direct

*via 101.1.1.1, Lo2, [1/0], 1d17h, local

*via 101.1.1.1, Lo2, [1/0], 1d17h, direct

102.1.1.1/32, ubest/mbest: 1/0

*via 10.0.152.127%overlay-1, [200/0], 1d17h, bgp-100, internal, tag 100 (mpls-vpn)

172.16.1.0/24, ubest/mbest: 1/0, attached, direct

*via 172.16.1.1, Vlan53, [1/0], 1d17h, direct

172.16.1.1/32, ubest/mbest: 1/0, attached

*via 172.16.1.1, Vlan53, [1/0], 1d17h, local

192.168.1.0/24, ubest/mbest: 1/0, attached, direct, pervasive

*via 10.0.152.65%overlay-1, [1/0], 1d17h, static

192.168.1.254/32, ubest/mbest: 1/0, attached

*via 192.168.1.254, Vlan33, [1/0], 1d17h, local

192.168.2.0/24, ubest/mbest: 1/0, attached, direct, pervasive

*via 10.0.152.65%overlay-1, [1/0], 1d17h, static

192.168.2.254/32, ubest/mbest: 1/0, attached

*via 192.168.2.254, Vlan49, [1/0], 1d17h, local

Leaf1#

Leaf1# sh ip int vrf T6:C1

Leafに展開されているSVI（端末のAnycast default Gateway)

IP Interface Status for VRF "T6:C1"(15)

Vlan33, Interface status: protocol-up/link-up/admin-up, iod: 22, mode: pervasive, vrf_vnid: 3014658

IP address: 192.168.1.254, IP subnet: 192.168.1.0/24

IP primary address route-preference: 1, tag: 0

Vlan49, Interface status: protocol-up/link-up/admin-up, iod: 16, mode: pervasive, vrf_vnid: 3014658

IP address: 192.168.2.254, IP subnet: 192.168.2.0/24

IP primary address route-preference: 1, tag: 0

Vlan53, Interface status: protocol-up/link-up/admin-up, iod: 14, mode: external, vrf_vnid: 3014658

IP address: 172.16.1.1, IP subnet: 172.16.1.0/24

IP primary address route-preference: 1, tag: 0

loopback2, Interface status: protocol-up/link-up/admin-up, iod: 36, mode: unspecified, vrf_vnid: 3014658

IP address: 101.1.1.1, IP subnet: 101.1.1.1/32

IP primary address route-preference: 1, tag: 0

Leaf1#

Leaf1# exit

このようにAPIC、SwitchへログインしCLIで種々の情報を確認することができます。

MITの情報を確認することによりポリシーモデルの抽象化された設定情報の確認や、それに関連する具体的なネットワークスイッチの状態をみることができます。

またスイッチへログインすることにより、実際にスイッチ上に展開されているVRFやVLAN、ルーティングテーブルの情報や、ファブリックのみつけている各エンドポイントのIP/MAC、接続先の情報などを具体的に把握することができます。

これによりAPIC コントローラーで管理をポリシーモデルで一元化しつつも、各スイッチレベルで具体的に展開されているネットワークの状態を確認できるので、万一の場合にもBlackbox化せず、トラブルシューティングをすることが可能です。