How should I troubleshoot admin account login issue to APIC?

[SIMMN]

I have a Nexus Dashboard cluster and when I tried to add ACI/APIC as site using the admin account, it just tells me login failure as below...I can use the same admin account to login from browser and also from postman...Any further log/debug I can use to see why the login from ND failed?

Also if I tried to add site using a radius account, it works...So what is going on with the admin account then?

 

[Robert Burns]

Does your APIC have multiple Auth Realms configured?

Robertg

[SIMMN]

yes, local and radius. Local is the default login domain.

[Robert Burns]

Are you trying to connect to the inband IP of the APIC or oob?

Robert

[SIMMN]

I used INB IP of APIC in ND for adding the site. But I tried both inb and oob in browser to login to APIC and both worked.

[Robert Burns]

Can you SSH with this user account from the ND CLI > APIC?  You may need to ensure you have a route for the APIC's Inband subnet defined on the ND Cluster config under the Data Network interface - if you can't reach it.

[rescue-user@ND-01 ~]$ ssh roberbur@[apic_ip]
**********************************
THIS DEVICE USES LDAP AUTH
PLEASE LOG IN WITH YOUR LAB
AD CREDENTIALS
**********************************
roberbur@[apic_ip]'s password:
Last login: 2021-10-21T01:58:01.000+05:30 UTC
S1-POD1-APIC1#

Robert

[SIMMN]

I definitely could try to ash from ND DATA to APIC INB. But I don’t think it is a routing issue. I can add the site with remote radius account and also from the APIC log/screen shot attached initially, the connection is there but login failed for whatever reason. 

also I checked ngnx log on the APIC but nothing there is useful to me…

[SIMMN]

Update (2021-10-21): The issue so far after my troubleshooting, it is likely a bug on the ND v2.1 and/or APIC 4.2 related to the password of the account used...My local admin account password has "@" symbol and I crreated another local account on APIC with the same permission but without "@" symbol in the password. The new account works just fine for adding ACI into ND... TAC case has been openned as well.

[Robert Burns]

Can you unicast me your SR #?  I'd like follow up internally on this.

Thanks,

Robert