In short, this sounds like a loop in the network.
If external IPs were learned as endpoints in an EPG, then traffic sourced from that external IP entered an ACI leaf on that EPG/VLAN. That is the only way for an endpoint to be learned.
Using the subnet check feature might be a workaround, but it doesn't mean that the issue is not ongoing.
If you do not have anything documented about the unexpected endpoint learning info, then you could try checking the EP Tracker and lookup an external IP which was learned on an EPG. If the search in EP Tracker is successful, then it should provide you with MAC address, EPG, and the interface which it was learned on. Once you know the interface of where external IP endpoint learning happened, then check the neighboring device. EP Tracker can be found in the GUI under Operations > EP Tracker.
If the incident occurred recently (last night or today), then immediately collect tech supports on the leaf switches (which learned the external IP as endpoints). If the EPM-trace.txt logs have not rolled over, then you will details about how the endpoint was learned. To collect tech supports on a switch, you could use the techsupport local command on each leaf switch. Takes about 5 minutes or so to complete. The tech support files will be located on the leaf switch under the /data/techsupport directory. If you decide to go down this route, then you may need assistance from TAC in parsing through EPM logs.
Thanks
Jason
