cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
20404
Views
35
Helpful
5
Replies
Highlighted
Beginner

ACI - How to clear endpoint manually

Current version :  2.1.1h / n9000-12.1(1h)

Hi,

The IP address (10.10.255.161) is no longer present in my network, but seems to be in stale state inside the ACI cache.

I would like to know how to manually remove this endpoint.

Maybe "Limit IP Learning to Subnet" or "End Point Retention Policy" could help to prevent against this behavior.

Below the output about this issue :

fb-lab-apic1# show endpoints ip 10.10.255.161
Legends:
(P):Primary VLAN
(S):Secondary VLAN
Dynamic Endpoints:
Tenant      : lab-labo
Application : lab-app
AEPg        : lab-epg
 End Point MAC      IP Address                                Node        Interface                       Encap            Multicast Address
 -----------------  ----------------------------------------  ----------  ------------------------------  ---------------  ---------------
 00:05:31:41:5C:00  10.10.255.161                             101 102     vpc l2labo-s101-vpcpg         vlan-4           not-applicable
Total Dynamic Endpoints: 1
Total Static Endpoints: 0

fb-lab-leaf102# show endpoint ip 10.10.255.161 detail    
Legend:
 s - arp              O - peer-attached    a - local-aged       S - static
 V - vpc-attached     p - peer-aged        M - span             L - local
 B - bounce           H - vtep
+-----------------------------------+---------------+-----------------+--------------+-------------+------------------------------+
      VLAN/                           Encap           MAC Address       MAC Info/       Interface     Endpoint Group
      Domain                          VLAN            IP Address        IP Info                       Info
+-----------------------------------+---------------+-----------------+--------------+-------------+------------------------------+
53                                           vlan-4    0005.3141.5c00 LV                        po9   lab-labo:lab-app:lab-epg
lab-labo:labo-vrf                        vlan-4     10.10.255.161 LV                        po9     
lab-labo:labo-vrf                        vlan-4      10.10.110.11 LV                        po9
lab-labo:labo-vrf                        vlan-4        10.18.4.84 LV                        po9
lab-labo:labo-vrf                        vlan-4       10.10.241.5 LV                        po9
lab-labo:labo-vrf                        vlan-4      10.10.120.15 LV                        po9
lab-labo:labo-vrf                        vlan-4      10.10.114.11 LV                        po9

fb-lab-leaf101# show endpoint ip 10.10.255.161 detail
Legend:
 s - arp              O - peer-attached    a - local-aged       S - static
 V - vpc-attached     p - peer-aged        M - span             L - local
 B - bounce           H - vtep
+-----------------------------------+---------------+-----------------+--------------+-------------+------------------------------+
      VLAN/                           Encap           MAC Address       MAC Info/       Interface     Endpoint Group
      Domain                          VLAN            IP Address        IP Info                       Info
+-----------------------------------+---------------+-----------------+--------------+-------------+------------------------------+
48                                           vlan-4    0005.3141.5c00 LV                       po10   lab-labo:lab-app:lab-epg
lab-labo:labo-vrf                        vlan-4     10.10.255.161 LV                       po10
lab-labo:labo-vrf                        vlan-4      10.10.110.11 LV                       po10
lab-labo:labo-vrf                        vlan-4        10.18.4.84 LV                       po10
lab-labo:labo-vrf                        vlan-4       10.10.241.5 LV                       po10


Thank you

Ju

Everyone's tags (1)
1 ACCEPTED SOLUTION

Accepted Solutions
Highlighted
Beginner

Ju, 

Ju, 

Anytime a leaf learns a local L3 endpoint it retains both the MAC and IP. Lets call this endpoint MAC-A and IP-A.  The leaf will keep this IP learned on this mac until either:

A) The IP is learned on a new mac (IP-A moves from MAC-A to MAC-B)

or

B) The mac address is cleared from the endpoint table

At 75% of the endpoint retention timer, the leaf will send out host tracking packets (ARPs) for the IP addresses associated to the mac. If your endpoint has multiple IPs associated to 1 MAC and that endpoint responds to any of the host track packets, then the leaf will refresh that endpoint retention timer with all IPs retained.

==========================

Possible Solutions: 

1.) Flush the endpoint table for the BD. (Warning this will remove all endpoints from the endpoint table within the BD. Potential outage could occur within this BD since it would have to re-learn all of the endpoints. Endpoints would not be flushed on any other BD/VRF)

Log into the APIC GUI. Navigate to the BD settings of where the endpoint exists. Change the L2 Unknown Unicast setting and click submit. If the setting if 'Flood' then change it to 'Hardware Proxy'. After changing and submitting the change, then the endpoint table will flushed. This only takes a couple seconds so you can change the setting back to your original configuration immediately after. 

2.) Clear single IP from switch. This method is not guaranteed to work but it is less impactive on other endpoints within the EPG/BD. 

Log into leaf/leaves which contain the endpoint. Go into the vsh mode by simply executing vsh. Once in vsh, then execute the clear endpoint command. 

# vsh

# clear system internal epm endpoint key vrf <vrf_name> ip x.x.x.x

Example below:

leaf# vsh
Cisco iNX-OS Debug Shell
This shell should only be used for internal commands and exists
for legacy reasons. User should use ibash infrastructure as this
will be deprecated.

leaf# clear system internal epm endpoint key vrf jw1:jw1 ip 10.10.10.10

-Jason

View solution in original post

5 REPLIES 5
Highlighted
Beginner

Ju, 

Ju, 

Anytime a leaf learns a local L3 endpoint it retains both the MAC and IP. Lets call this endpoint MAC-A and IP-A.  The leaf will keep this IP learned on this mac until either:

A) The IP is learned on a new mac (IP-A moves from MAC-A to MAC-B)

or

B) The mac address is cleared from the endpoint table

At 75% of the endpoint retention timer, the leaf will send out host tracking packets (ARPs) for the IP addresses associated to the mac. If your endpoint has multiple IPs associated to 1 MAC and that endpoint responds to any of the host track packets, then the leaf will refresh that endpoint retention timer with all IPs retained.

==========================

Possible Solutions: 

1.) Flush the endpoint table for the BD. (Warning this will remove all endpoints from the endpoint table within the BD. Potential outage could occur within this BD since it would have to re-learn all of the endpoints. Endpoints would not be flushed on any other BD/VRF)

Log into the APIC GUI. Navigate to the BD settings of where the endpoint exists. Change the L2 Unknown Unicast setting and click submit. If the setting if 'Flood' then change it to 'Hardware Proxy'. After changing and submitting the change, then the endpoint table will flushed. This only takes a couple seconds so you can change the setting back to your original configuration immediately after. 

2.) Clear single IP from switch. This method is not guaranteed to work but it is less impactive on other endpoints within the EPG/BD. 

Log into leaf/leaves which contain the endpoint. Go into the vsh mode by simply executing vsh. Once in vsh, then execute the clear endpoint command. 

# vsh

# clear system internal epm endpoint key vrf <vrf_name> ip x.x.x.x

Example below:

leaf# vsh
Cisco iNX-OS Debug Shell
This shell should only be used for internal commands and exists
for legacy reasons. User should use ibash infrastructure as this
will be deprecated.

leaf# clear system internal epm endpoint key vrf jw1:jw1 ip 10.10.10.10

-Jason

View solution in original post

Highlighted
Beginner

Had the same issue.  The

Had the same issue.  The shell method worked for me as well.  Thanks!

Highlighted
Beginner

Clearing the endpoint on the

Clearing the endpoint on the border leafs after a vMotion is also a workaround when hitting bug CSCuz19695.

https://bst.cloudapps.cisco.com/bugsearch/bug/CSCuz19695

Highlighted
Beginner

Re: Ju,

By the way, if the EP is behind a VPC, you need to clear it at the same time in both nodes.

 

Cheers,

Vladimir

Highlighted
Beginner

Thank you Jason for your

Thank you Jason for your detailed answer. It works :-)

Additionally, is there a way to find the timer associated to a dynamic endpoint ?

Regards

Ju