How to get all routing rules of a vrf via REST API query?

[paz.sadovsky@skyboxsecurity.co]

Hi,

I've managed to get all the routing rules in my APIC using this REST API query:

https://<APIC IP>/api/node/class/topSystem.json?query-target=subtree&target-subtree-class=ospfDom,bgpDom,eigrpDom,ipv4Dom,isisDom,ospfv3Dom,uribv4Dom&rsp-subtree=full&rsp-subtree-class=ospfRoute,bgpRoute,eigrpRoute,ipv4Route,isisRoute,ospfv3Route,uri...

and then I filter them by the tenant and vrf.
However, I get the routing rules per domain (ospf, bgp etc.), while what I really want is getting one combined routing table per vrf, much like running the CLI command "show ip route vrf '<TENANT>:<VRF_NAME>'" on the leaf.
Is there such a query that retrieves all routing rules of the vrf altogether?

Thanks in advance,
Guy

[micgarc2]

Are you looking for like an API call for all the routes on every leaf?  Why don't you just use "show ip route vrf all" on a per leaf basis?

You could also do this from the APIC CLI:

a-apic1# acidiag fnvread | egrep " active" | egrep "leaf|spine" | awk '{print $1}' | sed -e 'H;${x;s/\n/,/g;s/^,//;p;};d'

101,102,103,204,205,206,1001,1002,2001,2002,3101,3102,3201,3202  <-- gives you all your node IDs

Copy paste that and run the desired exam, it will run the show command on each node one by one

a-apic1# fabric 101,102,103,204,205,206,1001,1002,2001,2002,3101,3102,3201,3202 show ip route vrf all

This is a lot of information query though if you have a lot of leafs / a lot of routes / vrfs.

Thank you for participating in the Cisco Support Forum for ACI! If you have other questions related to this post, please let us know. If this response answers your questions, please mark this post "answered" and assign a rating to the response(s) provided. This will help notify other viewers that your question(s) is answered and this helps us provide better responses for this and future questions.

Regards,

Michael G.

[paz.sadovsky@skyboxsecurity.co]

Thanks for answering.
However, I'm looking for a REST API call that would replace "show ip route vrf all" APIC cli command.

[Remi Astruc]

Hello,

You could try that API call:

https://<APIC>/api/node/mo/topology/<pod ID>/node-<ID>/sys/uribv4/dom-<TENANT>:<VRF_NAME>/db-rt.json?query-target=subtree&target-subtree-class=uribv4Nexthop

Hope this helps

Remi Astruc

[paz.sadovsky@skyboxsecurity.co]

Thanks, but this call is relevant only for uribv4 domain. The request I've posted in my question already contains this data, among the rest of the domains (ospf, bgp, static routes etc.).
The problem is that I get the data per domain, i.e. bgp routing rules table alone, ospf routing table alone, static routes table alone, while what I really want is getting all routing rules together in one table, the same as I get when I run "show ip route vrf" on the APIC CLI.

[Remi Astruc]

Hello,

That API call I provided gets precisely the list of all the routes with next hop info for a given VRF, no matter if the routes come from BGP, OSPF, or other.

Have you tried to run it, and actually compare to your show ip route vrf? If so please explain the exact differences you see.

Or maybe you meant something else with "How to get all routing rules"?

[paz.sadovsky@skyboxsecurity.co]

I did try to run it but on Cisco LAB, and didn't get the static routes configured.
However, it also seems like APIC CLI is not available in Cisco LAB.
We'll run in a real env and update soon.
10x!

[paz.sadovsky@skyboxsecurity.co]

Indeed, it helped us get to the right answer :)

I used the following (per <TENANT:VRF>):
https://<APIC IP>/api/node/class/uribv4Dom.json?rsp-subtree=full&rsp-subtree-class=uribv4Route&query-target-filter=eq(uribv4Dom.name,"<TENANT:VRF>")

[Marcel Zehnder · Accepted solution]

Hi

Have you tried to query just the uribv4Route-MO?

https://{{IP}}/api/class/uribv4Route.json?query-target-filter=wcard(uribv4Route.dn,"<TENANT>:<VRF>")&rsp-subtree=full&order-by=uribv4Route.dn|asc

(you need to replace <TENANT> and <VRF> with the corresponding names...)

HTH

Marcel

[paz.sadovsky@skyboxsecurity.co]

Will do.
It seems like we cannot get correct results from Cisco LAB, but we will try it on a real env and update soon.
10x!

[paz.sadovsky@skyboxsecurity.co]

It worked! 10x!

[peterzhang]

FYI, you can also login to the APIC, or Switch to check the API log to see exactly how the show command output is generated. The output may not be exactly what you see, but the data structure is definitely from the API query. Log is at /var/log/dme/log/access.log