Hi everyone, We were wondering if it is possible to shape egress traffic in an EPG; we cannot apply DPP under the L3Out because it will be shared between more than 100 final customers and we need some internet access control for download & Upload. T...
Forum Posts
Hello all,We recently upgraded the CIMC version on one of our APIC's (APIC1) to 4.1(2k), and afterwards APIC1 has fallen out of the cluster. I do have local admin access to APIC1, and running avread on APIC1 I can see that APIC1 only sees itself as a...
Assuming I have a service graph that redirects the traffic to a pair of HA firewalls. Aside from the recommendation that the IP SLA timer (probe frequency x multiplier) for PBR Policy should be greater than the actual firewall failover timer, are the...
Resolved! Cisco ACI and physical switch ports?
I’ve been reading and watching many videos on how to configure and Application on ACI. I understand that you create an application profile and in that profile you create endpoint groups. Each group is linked to a broadcast domain. Each broadcast doma...
We recently migrated a pair of 4451 CUBE routers into our ACI fabric. Once we migrated layer 3 into the fabric, we started seeing issues where the CUBE VIP would go unresponsive for a minute or two - which takes the SIP trunk offline and drops all ac...
Hi folks, A client of mine is experiencing a "connection timed out" between endpoints in the same EPG. The issue happens infrequently. Upon checking under EP tracker, most of the endpoint pairs reside under different vPCs (on the same Leaf pair). The...
Hello, How we can deploy a firewall to secure EAST-WEST traffic in ACI without service graph? traffic between EPGx and EPGy must pass via firewall. Thank you,
Resolved! ACI L3Out with both BGP and OSPF?
Reference the screenshot below captured on a v4.2 fabric. Does it mean if I have both OSPF and BGP configured under the same L3Out, BGP would take precedence over OSPF for advertising fabric BD prefixes externally? If so, it is something new I learne...
Is it possible to use switch-to-switch MACSEC encryption between two Catalyst 9300s that are connected to different leaf switches, at different sites, of an Cisco ACI multipod setup? The MACSEC ports on either end would be connected to the same EPG i...
I'll preface this by saying I am sysadmin, not a network engineer but I have been given read-access to the ACO console so I can review the L3 drop/permit logs. I am looking for an automated way to export the logs so my co-workers can also see them. H...
When upgrading from a 36-port linecard to a 32-port linecard on a 9508 chassis, the reduced ports (33-36) are left in a invalid-path state. Apparently the fabric is still trying to configure these ports, raising fault F1209: Fault delegate: Confi...
Hello all,In the APIC Data Sheet I see an APIC-CLUSTER-XS listed - basically an "extra small" APIC cluster with 1 physical M3 APIC and 2 virtual APIC's.However I can't find any documentation that discusses this deployment and what it would look like ...
Resolved! CRITICAL - threshold-crossed
I have reviewed the Faults tab and I found some records like this: Affected Object: comp/prov-VMware/ctrlr-[DVS_HX-VM-NETWORK]-VCMEGA/vm-vm-3589 Description: TCA: CPU usage average value(compHostStats15min:cpuUsageAvg) value 100% raised above thres...
Resolved! Attach EPG to existing AEP with REST API
Hi,I am trying to attach an existing EPG to an existing AEP with the REST API.This is the config I have:"infraRsFuncToEpg":{"attributes":{"dn":"uni/infra/attentp-{{aep}}/gen-default/rsfuncToEpg-[uni/tn-{{tenant}}/ap-{{app_profile}}/{{epg}}]","encap":...
Hello all,I am due to refresh one of our datacenters' APIC clusters. Currently it is a Large cluster (APIC-L2). However we have recently reduced the number of Leafs in that fabric from 24 down to 6 Leafs. There are 2 Spines in the fabric also.With on...
