Management preference for you and your environment is a decision best made by your networking team. That said, what ever management strategy that you choose does matter.
In regards to INB vs. OOB, remember INB & OOB is for “management” of ACI nodes. That is APICs, Leaf nodes, Spine Nodes, etc…
External Data collectors like Syslog, SNMP, and Callhome features communicate to the ACI nodes via INB, OOB, or Both.
If both in-band and out-of-band management policies for ACI nodes (APIC\Leaf\Spine) are configured correctly & successfully deployed; the in-band management interface is the preferred management interface. Even if you configure a policy to use the out-of-band management EPG, the ACI node will still use the in-band management interface.
The exceptions to the in-band management connectivity preference are:
* The Destination IP address for the policy resides in the out-of-band management network.
* The ACI Node receives a request packet destined to the node's IP address of the out-of-band management interface. The ACI Node will reply to the request using the out-of-band management interface.
Originally, there was no way to change this management connectivity preference for ACI nodes. So in the latest versions ACI firmware, a feature was added to toggle between in-band and out-of-band connectivity on the APIC server for management access to devices such as authentication servers or SNMP servers external to the ACI fabric. A requirement for this feature for the toggling between in-band and out-of-band connectivity to have effect, Both in-band or out-of-band management must already be configured.
Note: As noted above, this toggling between in-band and out-of-band connectivity feature will only change the management connectivity preference on the APIC controllers not the leaf or spine nodes. The leaf & spine nodes will continue to use the in-band management connectivity preference.
In troubleshooting your issue, here are some things to try:
- if you are using INBAND management with OOB, disable INB management by simply unconfiguring INB static node management addresses for all of the nodes. Then make sure the management EPG for your SNMP configuration is set to OOB.
- For OOB & INB, make sure that you have Static node management addresses configured for ALL nodes including the APICs. Most ACI Administrators forget to configure static node management addresses for APICs since they configured them during the setup script.
- For contracts for the OOB, use the "default" common filter to allow all for the testing of the feature. Also, use 0.0.0.0 for the subnet on the external management instance for testing feature.
- Make sure that your SNMP Collector's IP is configured in the SNMP Client groups in the SNMP fabric policies.
- Are you using SNMP v2 or v3? If v3 make sure all of the v3 parameters are configured.
- What does the following commands show on the APIC(s):
- netstat -aon | grep ":161"
- netstat -lp | grep "snmp"
- show snmp clientgroups ( you can xxxx out the IP addresses)
- moquery -c vzEntry | egrep -A 2 "161"
- moquery -c vzEntry | egrep -A 2 "162"
- moquery -c mgmtSubnet
- moquery -c mgmtRsOoBCons
- moquery -c vzOOBBrCP
- moquery -c snmpRsEpg | egrep "snmp.RsEpg|dn|tDn"
- ps aux | grep snmp
Also what version are you running?
Thanks
T.
