BD Default gateway not pingable from single static path
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
06-29-2017
05:00 AM
- last edited on
03-01-2019
05:16 AM
by
NikolaIvanov
Hello,
I'm currently facing a rare issue, I configured a static path in an EPG linked to a specific interface on my first LEAF.
The configuration seems to be OK but I can't ping the BD subnet (gateway IP).
If I configure a VPC as static path inside the same EPG, I'm than able to ping the BD Subnet (gateway).
Even more disturbing, if I try to ping the server connected on the single path from the server connected on the VPC it also work which means that the Vlan is correctly configured and I have communication.
Can you help me to find why my single path can't ping the BD subnet ?
Thanks in advance for your help.
Best regards,
Julian
- Labels:
-
Cisco ACI
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
07-05-2017 09:26 PM
Hello Julian,
A few things to look at here:
1) Under the EPG you are having issues with, do you see the EP as "learned" in the "Operational Tab". You can see this in the EPG tab.
2) I would go back and verify your access polices:
- First make sure the interface you are using is tied to the correct switch profile and that the interface selector is tied the correct AAEP.
-The AAEP is bascially the meeting point for the port and the VLANs.
3) Once that is verified, please make sure the correct domain is tied to that AAEP and that domain has the pool that contains the VLAN in which you are tagging in the static binding.
4) Verify that the correct domain is tied to the EPG.
5) Under the BD tied to that EPG, make sure the subnet is configured correctly with the correct subnet mask. Then verify the subnet mask on the device in which you are trying to ping with to make sure they both match.
6) Under the L3 configurations in the BD make sure unicast routing is enabled or else we can not perform routing in that BD. If it is not and you check that and still no luck you may need to flush the EP and try your test again. You can do this by flapping the BD. To do this you can go to the main tab in the BD and click L2 unknown unicast to "flood", submit this, then check it back to "hardware proxy" and submit.
** Note, do this during a MW because it will flush all the EPs in the BD and relearn them **
Are you receiving any faults when you deploy the static binding in question?
Please let me know if you are still having issues.
Regards,
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
07-31-2017 01:13 AM
Hi Michael,
Thanks for the answer and I would like to apologize for the late answer (I was in holiday).
In the "Operational Tab" of my EPG I can see the MAC/IP Association table and it is automatically learned.
Now I'm facing another strange issue, some of the machine in the EPG can ping the gateway, but other not.
So in the same Vlan I have 3 machine and 2 of them can ping the gateway (and be accessible from the network). This only happen with my VMWare hosts, I don't have this kind of issue with my WIndows Hosts.
Do you have an idea on what could go wrong ?
Thanks in advance for your help.
Best regards,
Julian
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
07-31-2017 06:28 AM
Hi Julian,
There a few things you need to look at. Is the EP that is not able to ping the GW learned in ACI (is it showing in the operational tab)? If so, I would take a look at the following.
-Make sure the bridge domain tied to that EPG has the correct BD subnet defined under the L3 configurations.
-If that subnet is correct, I would double check the network settings on the VM itself to make sure the GW matches.
Also, are all these EPs within the EPG in the same subnet?
Regards,
Michael G
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
08-04-2017 02:26 AM
Hi Michael,
In the screenshot there is 4 EP's learned. The 2 first and the last one are located on the VMWare host linked with a lagg interface on a VPC on the ACI.
The network is a /26 range.
The third EP in the list is a VM located on a Hyper-V host also connected with a lagg on a VPC.
The VM's on VMWare can't ping the BD subnet IP (Gateway) but the VM on the Hyper-V can.
It's really strange.
Best regards,
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
08-04-2017 05:02 AM
Hi Julian,
Can you verify on the vCenter side that you have vlan-200 correctly associated to the port group where these VMs live off? Also what type of deployment is this? UCS-C, B, HP, etc?
Thanks,
Michael G.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
08-06-2017 11:22 PM
I verified the Vlan Association and it's all good.
The hardware is supermicro superblade.
When I'm doing a tcpdump, I see a lot of ARP request from the VM interface but no ARP Reply.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
08-08-2017 06:35 PM
Are you performing a tcpdump on the VM itself or on the ACI leaf? Is this issue seen only on one specific host? If so can you get a capture on the uplink connected to the ACI leaf? This is the command from the ESXI shell if you are using ESXI as your hypervisor:
pktcap-uw --uplink vmnic#
#- enter vmnic number
