Rougue endpoint

[patrikvarga11]

Hi,

I have an ACI fabric with a server connected to a leaf pair through a vPC. Several VLANs are carried over that vPC to the server.

An endpoint from one VLAN is constantly flagged as rogue endpoint.

The same IP keeps bouncing between on the same leaf pair. When I look at the endpoint table, that IP shows up
under two different MAC addresses.

If I shut down those IPs on the server, the faults stop right away. Bring them back and it starts again within a minute.

Any ideas please?

[Daniel Slyk · Accepted solution]

Hi,

The fault is telling you exactly what the fabric sees, the same IP is being sourced from two different MACs,
so ACI keeps re learning it and flags it as rogue.

Check the NIC configuration on the server.
If your vPC is a proper LACP port-channel on the ACI side, the host must be running a single bond LACP.
If the two NICs are configured as independent interfaces or a non LACP active/active, both of them can send
traffic with that IP, each with its own MAC, and that's the flapping you see.

Let me know.

[patrikvarga11]

The server was misconfigured, we fixed it.

Thank you.