ACI CLI to show which leaf access policy-group AEP is attached to

[Hongjun Ma]

Hello, in APIC GUI AAEP entry, I can see which policy-group this AEP is attached to from "Operational" tab. I can't find such information from APIC CLI. Any suggestions?

[Marcel Zehnder · Accepted solution]

Hello

You can query this information with the following command:

moquery -c infraAttEntityP -x 'query-target-filter=eq(infraAttEntityP.name,"<AEP-NAME>") rsp-subtree=full rsp-subtree-class=infraRtAttEntP'

Or you can also query direct for the infraRtAttEntP:

moquery -c infraRtAttEntP -f 'infra.RtAttEntP.dn*"attentp-<AEP-NAME>/"' | grep tDn

You have to replace <AEP-NAME> with the name of your AEP. For example to get all Policy-Groups which have the AEP "AEP-TEST" configured:

moquery -c infraAttEntityP -x 'query-target-filter=eq(infraAttEntityP.name,"AEP-TEST") rsp-subtree=full rsp-subtree-class=infraRtAttEntP'

moquery -c infraRtAttEntP -f 'infra.RtAttEntP.dn*"attentp-AEP-TEST/"' | grep tDn

HTH

Marcel

[RedNectar · Accepted solution]

I think the fact that Marcel had to resort to moquery commands is an indictment of Cisco's pathetic attempt of a CLI for the APIC.

Message to Cisco - time to give us some useful show commands at the APIC CLI, like show local-station-table and show global-station-table, and simple things like show aaep [detail]

Anyway, I thought I'd try Marcel's incredibly complicated commands and they quite simply didn't work for me - got no output - even using cut-and-paste and carefully replacing the AAEP name.

However, I got what I think Hongjun Ma was after by using the same moquery like this:

moquery -c infraAttEntityP | grep my-aaep-name

Much simpler.

Eg

apic1# moquery -c infraRtAttEntP | grep T9:HostLinks-AAEP
dn           : uni/infra/attentp-T9:HostLinks-AAEP/rtattEntP-[uni/infra/funcprof/accportgrp-T9:SA.Host-APPG]
dn           : uni/infra/attentp-T9:HostLinks-AAEP/rtattEntP-[uni/infra/funcprof/accbundle-T9:L101..102:1:43-VPCIPG]

I hope this helps

---

Don't forget to mark answers as correct if it solves your problem. This helps others find the correct answer if they search for the same problem

---

[Marcel Zehnder]

Message to Cisco - time to give us some useful show commands at the APIC CLI, like show local-station-table and show global-station-table, and simple things like show aaep [detail]

Well, I don't agree...actually I think it's the other way around: Time for us to say bye-bye to the legacy CLI and get use to the API!

Just my 2 cents

Marcel

[Hongjun Ma]

Thank you @Marcel Zehnder and @RedNectar!

I do feel NX-OS CLI should cover these. API and moquery is powerful and can get down to the root of MO but you do have the learning curve of dealing with remember/cut/paste syntax, payload struct and programming language, it'll be hard for it to be adopted easily. We should balance the power of the API and the easy of use of the CLI.

I like NX-OS CLI's ability to give me a quick overview of the ACI config and status but find it's lack to show it's upstream association and I think it should be enhanced in this perspective. For example, currently from CLI I can see see which vlan-domain include which vlan, which interface profile include which interface(the flow is from top to bottom). However it's not easy to see from other direction(from bottom to top), like which vlan is being used by which vlan-domain, which AAEP is being used by which policy-group, which policy-group is used by which leaf int profile....

something like "show int policy-group <name> used-by"

will be very helpful so users can quickly understand how objects are associated with each other.

[YanL]

Hello I'm after this exact output - > something like "show int policy-group <name> used-by".

I need to list all objects that are consumed by an Interface Policy Group, can someone help with the moquery required?

Basically I need to move physical connection from leaf VPC pair1 to leaf VPC pair2 and need to know where I need to flip the node numbers. ie Static Ports, L3OUT SVI, etc...

thank you

[RedNectar]

---

@YanL wrote:

Hello I'm after this exact output - > something like "show int policy-group <name> used-by".

I need to list all objects that are consumed by an Interface Policy Group, can someone help with the moquery required?

Basically I need to move physical connection from leaf VPC pair1 to leaf VPC pair2 and need to know where I need to flip the node numbers. ie Static Ports, L3OUT SVI, etc...

thank you

---

Sounds like a worthy question. You should ask it. But this thread is about ACI CLI to show which leaf access policy-group AEP is attached to - so it's off topic here.

By asking this as a new question, it helps search engines and people in general find the right thread if they have the same or similar question.

In the meatime, I'll do a little research to see if I can find an answer.