Find all encap vlans configured & used

[raza555]

Hi,

I am running out of VLANs, so need to do the VLANs audit;

- I believe that as standard VLAN, I can configure 2 to 4094 VLANs on ACI?

- All VLANs that I need to configure should be configured in VLAN POOLs?

- How I can check from CLI that which VLAN POOLs I have configured. I am using below MO cmd, please suggest if any other better command

APIC-01# moquery -c "fvnsAEncapBlk" | egrep "rn|llocMode|dn"

- How I can check that which encap VLANs are currently in use, if command can suggest that if its used in which EPG/L3O-SVI that will be best.

Many Thanks,

[Jayesh Singh · Accepted solution]

Hello Raza,

There is a very interesting APIC cli command that provides detailed info about the VLAN pool, allocation(EPG or ext-svi) and free VLAN IDs.

APIC01# show vlan-domain detail

There are more options available with that command to narrow down your query,

APIC01# show vlan-domain ?
<CR>
detail vlan-domain in detail with concrete MOs
leaf Leaf id
name Vlan-domain name
vlan VLAN ID 1-4094 or range(s): 1-5, 10 or 2-5,7-19

Hope that helps!

Regards,

Jayesh

***Rate all helpful posts. Mark it as a solution if that solves your problem, it might help other users who have the same query.***

[Sergiu.Daniluk · Accepted solution]

Hi @raza555 

The command provided by @Jayesh Singh is what you are looking for to search for (un)used vlans (your last 2 questions).

About your other questions:

- I believe that as standard VLAN, I can configure 2 to 4094 VLANs on ACI?

S.D.: Theoretically speaking you can use any vlan from range 1-4094 (4095 is reserved in ACI). Practically speaking, since the range 3968 to 4095 is usually a reserved vlan range for most of the platforms (including Nexus 9000 running NXOS), it would be a best practice to not use this range. Vlan 1 is also a "special" which I would STRONGLY recommend for anyone not to use it in their network. As a summary, I would recommend you use only the vlan range 2-3967.

- All VLANs that I need to configure should be configured in VLAN POOLs?

S.D.: Yes. All vlans needs to be configured in a vlan pool, which is part of a domain. The domain is associated to interfaces through the use of AAEP, and also associated directly to the EPGs.

If you are running out of vlans, what you can try is using the "per-port vlan" feature. It allows you to use the same vlan on same leaf, different ports, different EPGs. If you want to learn more about it, take a look at @RedNectar's article: https://rednectar.net/2016/12/11/cisco-aci-per-port-vlan-feature/ or check the community document: https://community.cisco.com/t5/data-center-documents/per-port-vlan/ta-p/3164234

Stay safe,

Sergiu

[José E. Contreras Q.]

Vlans encap in use:

moquery -c vlanCktEp | grep "^encap" | sort -u

Regards.