Strange case on L3out

[compterds]

Hello everyone,

I'm currently testing L3out by statical route on my fabric.

I followed many documentation for configuring everything (Tenant, EPG, BD, Subnet, L3out contract, and so on)

I've an endpoint 10.68.36.56 behind one leaf under "test" EPG on interface 1/28 frome leaf 1101.

From that endpoint, I can succesfully ping external network. 10.0.0.0/8 (Contract seems to work)

But from my external network, the only thing that I can do is pinging the gateway from my BD (10.68.36.1) but it doesnt work when I'm trying to ping 10.68.36.56...

If someone got an idea, I would appreciate your help 

Yoann

[Joseph Young]

-Are there any other BD SVI's configured in ACI that you can ping from the endpoint? Just to rule out gateway issues. Additionally if you don't have access to the endpoint you can source a ping from a non-connected bd svi using "iping -V <vrf name> <endpoint ip> -S <source ip>". You can get the vrf name with "show vrf".

-Contracts are not applied when pinging an address configured in ACI. If this is not a prod environment you can set the vrf mode for the endpoint to 'unenforced' to see if that causes the flow to work and isolate to a policy issue.

-If you can't change the mode another thing you can do is "show logging ip access-list internal packet-log deny | grep <endpoint ip>" on the border leafs and on the internal leafs to determine if it is being contract dropped.

[compterds]

Hello Joseph,

When I used show logging ip access-list internal packet-log deny | grep 10.68.36.56 on my 2 border leaves, it was empty. Whereas on my leaf 1101, there was many lines (as you can see on the attached file issue_leaf1101_endpoint10683656.txt)

My VRF was already in unenforced states.

I've done several commands on my service leaf (where sit the endpoint behind the BD and so on) and the output is in the file called "show_apic_leaf_forissue.txt".

I'm still trying to understand what's wrong with my configuration..

Thank you in advance for your help

Yoann

[Joseph Young]

Thanks for that output. I don't see any problems just from that. What kind of OS is the endpoint? Can you get a capture going on the host nic to see if traffic is actually making it to that point?

[rgavandi]

Please verify the BD enforcement in VRF, please remove the tick.