Not finding IP address of end hosts connected to the leaf switch

[Thiyagarajan K]

Hello All,

I'm troubleshooting an issue in Cisco ACI, where I'm not finding the end point IP address being learned on the leaf switch.

I'm sure the end hosts are connected to leaf switch configured with an IP but I'm not finding the host IP address being learned on the leaf switch.

Could anyone guide me where to start the troubleshooting on ACI and how to rule out the possible cause of the issue?

Regards,

Thiyagu

[Marcel Zehnder]

Hi Thiyagu

Do you see any endpoints at all? If you do not see the IP, this could be because unicast routing is not enabled on the corresponding bridge domains.

Could you please ssh to one of your APICs and enter the following command:

moquery -c fvCEp | egrep "dn|mac|ip"

If you see only 0.0.0.0 entries for your IPs you have to enable unicast routing under the bridge domain L3-settings. If you don't get any output at all there is some other (config-) problem (most likely a nwissue) --> Check out: http://www.cisco.com/c/en/us/td/docs/switches/datacenter/aci/apic/sw/1-x/troubleshooting/b_APIC_Troubleshooting/b_APIC_Troubleshooting_chapter_0111.html

[Thiyagarajan K]

Thanks a lot Marcel. We have the design as like the Leaf switch 1 connected to primary firewall and leaf switch 2 connected to secondary firewall. 

When the primary firewall is active I'm finding the endpoint IP address on the leaf switch. whereas when the secondary firewall is active I'm not finding the endpoint IP address on the leaf switch.

Could you please help me on this issue scenario how to narrow down the issue.

Regards,

Thiyagu

[Marcel Zehnder]

Hi thiyagu

We need a little more specific information:

-as i unterstand you connect a  active/standby fw pair to an epg via static binding/port?

-if you do a failover you don't learn IPs anymore

-which IPs exactly? The IPs of the firewall? The IPs of your endhosts?

-Are your endhosts and the fw part of the same epg?

-your firewall is acting as the default gw for the epg?

-could you post the config of the related epg and bd?

It's a bit difficult to help you without fully understanding the issue ;-) Maybe you should open a tac case.

[Thiyagarajan K]

Thanks a lot guys. I will open a TAC case to work on this issue.

[Tomas de Leon]

You can go to the leaf switch with hosts and run:

leaf# vsh_lc

vsh_lc

module-1# show system internal epmc endpoint all | egrep "MAC :|IP#|VRF name :|phy if :"

MAC : 0000.0000.0000 ::: Num IPs : 1
IP# 0 : 193.1.37.201
VRF name : deadbeef-dhcp3:dhcp3-v1 ::: VRF vnid : 2981889
phy if : 0 ::: tunnel if : 0x18010004 ::: Interface : Tunnel4

MAC : 0050.5689.66b6 ::: Num IPs : 0
VRF name : deadbeef-dhcp3:dhcp3-v1 ::: VRF vnid : 2981889
phy if : 0 ::: tunnel if : 0x18010004 ::: Interface : Tunnel4

MAC : 0050.5689.bff2 ::: Num IPs : 4
IP# 0 : 2002:192:2:26::8 ::: flags: locally-aged|host-tracked|
IP# 1 : 2002:192:2:26::252
IP# 2 : 2002:192:2:26:c411:f1e3:ef74:85c1 ::: flags: host-tracked|
IP# 3 : 192.2.26.252
VRF name : deadbeef-dhcp3:dhcp3-v1 ::: VRF vnid : 2981889
phy if : 0x16000002 ::: tunnel if : 0 ::: Interface : port-channel3

MAC : 0050.5689.85e6 ::: Num IPs : 2
IP# 0 : 2002:192:2:28::252 ::: flags: locally-aged|host-tracked|
IP# 1 : 192.2.28.252 ::: flags: locally-aged|host-tracked|
VRF name : deadbeef-dhcp3:dhcp3-v1 ::: VRF vnid : 2981889
phy if : 0x16000002 ::: tunnel if : 0 ::: Interface : port-channel3

MAC : 0050.5689.fdce ::: Num IPs : 1
IP# 0 : 193.1.37.254
VRF name : deadbeef-dhcp3:dhcp3-v1 ::: VRF vnid : 2981889
phy if : 0x16000002 ::: tunnel if : 0 ::: Interface : port-channel3

MAC : 0050.5689.bf83 ::: Num IPs : 1
IP# 0 : 193.1.38.201
VRF name : deadbeef-dhcp3:dhcp3-v1 ::: VRF vnid : 2981889
phy if : 0x16000002 ::: tunnel if : 0 ::: Interface : port-channel3

MAC : 0050.5689.2510 ::: Num IPs : 1
IP# 0 : 192.2.27.105 ::: flags: host-tracked|sclass| ::: sclass : 32775
VRF name : deadbeef-dhcp3:dhcp3-v1 ::: VRF vnid : 2981889
phy if : 0x16000002 ::: tunnel if : 0 ::: Interface : port-channel3

MAC : 0050.5689.2db8 ::: Num IPs : 1
IP# 0 : 2002:192:2:29::6
VRF name : deadbeef-dhcp3:dhcp3-v1 ::: VRF vnid : 2981889
phy if : 0x16000001 ::: tunnel if : 0 ::: Interface : port-channel2

MAC : 0050.5689.286e ::: Num IPs : 1
IP# 0 : 192.2.25.101 ::: flags: host-tracked|sclass| ::: sclass : 49156
VRF name : deadbeef-dhcp3:dhcp3-v1 ::: VRF vnid : 2981889
phy if : 0x16000001 ::: tunnel if : 0 ::: Interface : port-channel2

MAC : 0050.5689.7e8a ::: Num IPs : 1
IP# 0 : 193.1.37.102
VRF name : deadbeef-dhcp3:dhcp3-v1 ::: VRF vnid : 2981889
phy if : 0x16000001 ::: tunnel if : 0 ::: Interface : port-channel2

Copy results into a text and search for the mac address in question or use grep on the above command.

This will get you started

T.