Cisco ACI - Can ping gateway (BD) but not endpoints

[NInja Black]

 I can ping the gateway from a switch connected through L3Out (ospf) but not the VMs. I see the VM IPs under operational tab of the EPG and they are being learned. I see all the routes being learned through OSPF on the L3Out. Also I can see the ospf external -2 route for the network from the exernal L3 Switch.

Is there anywhere on the L3Out config I need to 'allow' this network to be advertised outside the fabric? Just checking 'advertise externally' and associating to adding) the L3Out under the BD config should be enough correct? 

[scherrav]

Are the EPGs and L3out in same VRF?

Do you have contracts setup for the EPG and the L3out?

From the leaf where you learn the VMs, are you able to ping them?

Under L3out are you allowing the subnets you want into ACI? Alternately you can use 0.0.0.0/0

[sharmayogita]

Hi folks, I am also facing the same issue where the BD gateway is reachable but endpoint is not even pinging from the L3 switch where the L3 OUT is connected and OSPF configured. This L3 switch is learning the endpoint host route i.e./32 route.

[scherrav]

@sharmayogita 

1. BD gateway is reachable >> from where?

2. endpoint is not even pinging from the L3 switch >> does the endpoint have a firewall blocking pings?

[sharmayogita]

Thanks for your reply 

1. BD gateway is reachable >> from where? BD gateway is reachable from the L3 switch with which L3 OUT and OSPF is configured and in fact reachable from outside network.

2. endpoint is not even pinging from the L3 switch >> does the endpoint have a firewall blocking pings? No it doesn't have any firewall blocking. We tested with different endpoints but behavior is same. Additionally, external network is reachable and services like MS teams and all available from the endpoint though its not pinging from outside.

[scherrav]

If the host is unable to ping the BD SVI (which is its gateway), please double check if the host/endpoint has the correct gateway configured.

If BD SVI is pingable from host, then make sure you have permit contract between L3out and host EPG.