Same BD but cannot communicate in ACI

[niceinfotech]

Can someone please help this is very urgent. I have this configuration in the ACI where all the Subnets reside in 1 BD and 1 VRF as shown in the diagram. Additional to this I have configured the L2OUT adding the subnet again and contracts respectively. All the configuration seems ok, have applied the contracts also properly but the problem is that I can communicate from PC(Vlan110) to the Server(vlan111) but not vice versa.

[niceinfotech]

Sorry i send the wrong diagram please refer to this new diagram

[RedNectar · Accepted solution]

Hi @niceinfotech ,

First, some tips. Trust me, there is a full answer below.

RedNectar's Forum Tips:

• When you add pictures, add your pictures inline - i.e. PASTE your picture right where you want it.  If it is a screenshot, you'll probably then want to click on the image and make the image large - like this.

 Po

This means you pictures are actually SEEN (a) in the email that gets sent to subscribers and (b) anyone who looks at this post in the future. Adding pictures as attachments... puts your submission into the TL;DR category.

---

• When pasting code/CLI output, expand the top menu by clicking the ellipsis 
  

  This will give you access to the paragraph formatting drop down

• Choose Preformatted 

• After clicking Preformatted, click HTML and paste your content between the <pre> </pre> tags.  This will stop multiple spaces being squeezed into a single space.

</end of RedNectar's Forum Tips>

---

Now to your question - and let's put the diagrams in to make it readable:

Can someone please help this is very urgent. I have this configuration in the ACI where all the Subnets reside in 1 BD and 1 VRF as shown in the diagram.

Additional to this I have configured the L2OUT adding the subnet again and contracts respectively. .

Let's start with the L2Outs.

My advice is NEVER use L2Outs, use Application EPGs instead. L2Outs are an abomination and do NOTHING to enhance ACI. More detail in this answer I gave previously

Also, adding Subnets to the L2Out (or Application EPG when you migrate your config) is not necessary and only confuses the matter when you have Subnets on the BD.  You either put the subnet(s) on the BD or the EPG (or L2Out) to keep things simple and avoid confusion.  The only time you NEED to put a subnet on an EPG/L2Out is if it is the PROVIDER of a contract that is consumed by an EPG/L2out IN ANOTHER VRF.

Since you have only one VRF, just stick to putting the IP addresses on the BD.

All the configuration seems ok, have applied the contracts also properly but the problem is that I can communicate from PC(Vlan110) to the Server(vlan111) but not vice versa

You SAY you have "applied the contracts", but you have not shown any evidence of the contracts.

HOWEVER, this is of no consequence, because you have set the VRF Policy Control Enforcement to Unenforced.

So. What now?

This is what I advise:

VALIDATE ACCESS POLICIES

1. From Fabric > Fabric Policies >> Pools > VLAN , select the VLAN Pool that contains VLAN 110 and VLAN 111
   1. Click Show Usage, as validate that nodes Leaf 101 and Leaf 102 appear
   2. Click the link saying Click to show Detail
   3. Validate that Eth1/41 appears in the Usage Details
   4. Repeat (2) for the other leaf

IN YOUR TENANT

1. Delete the L2Outs
2. Create an Application Profile
3. Create two new Application EPGs, link each to the existing BD
4. Link Each EPG to the Physical Domain that contains the Access Policy Chain for the VPC
   1. Validate that the VPC shows up when you navigate to the EPG > Operational >| [Configured Access Policies] tab
5. Configure a Static Port mapping on the VLAN110_EPG to the VPC on VLAN 110
   1. Validate that your VLAN 110 server can ping default gw
6. Configure a Static Port mapping on the VLAN111_EPG to the VPC on VLAN 111
   1. Validate that your VLAN 111 server can ping default gw
   2. Validate that servers can ping/communicate with each other
7. Create appropriate contracts and apply them between the EPGs
8. Set the VRF Policy Control Enforcement to Enforced.
   1. Validate that servers can ping/communicate with each other