“Datacenter troubleshooting guide” – a blog by Gilles Dufour.
Day 3 – Looking at DP info
Last week, we had a look at the command show np 1 access-list trace vlan.
This command is quite important for many reasons.
Today we will look more into it.
But first, let's talk about the ACE design.
An ACE is composed of a Control Plane (CP) and a Data Plane (DP).
The CP is responsible for all the administration tasks, like managing the configuration, sending probes, keeping the stats,...
The routing/switching and loadbalancing is done by the data plane (DP).
Therefore, when you configure a new policy to loadbalance a new service, you enter the configuration at CP level. This configuration is processed by the ACL-MERGE function from CP and it is then push down to DP.
When you do a 'show run' or a 'show service-policy' you look at information inside the CP.
But when you enter a command that often starts with show np, you look at information from the DP itself.
Most of the time, what you have configured at CP level is reflected at DP level.
But it may occur that the acl-merge process fails for some reason and therefore you end up with different configurations between CP and DP.
This is why it is important to look at DP info.
Going back to our command show np 1 access-list trace, this is a DP command.
It will retrieve the actions that DP will perform on your traffic.
We have seen last week the "vserver" action which is the loadbalancing one.
But there are other possible actions.
For example, if you configure a parameter-map to change the idle timeout.
The parameter-map with id 81 (0x51) will be associated to this traffic.
To find out more about that parameter-map, we won't use the show cfgmgr internal table command as we did before.
Instead, we will look at this object inside DP itself.
switch/Admin(config-pmap-c)# do show np 1 me-stats "-n 81" Conn Policy Entry at Index: 81 ------------------------------- MSS Max: 1460 MSS Min: 0 FIN Timeout: 3600 secs Rx Buf Share: 32768 Timewait: NONE Nagle: Disabled EmbryTO: 5 secs Tx Buf Share: 32768 Rnd intial Seq: yes Slow Strt Disabled: 1 Enque Limit: 36 SYN retry Cnt: 4 WS Factor: 0 Client Keep-Alive: 1 ACK Delay TO: 200 ms SACK enable: 1 Timestamp enable: 1 Wind Scale Enable: 1 SYN Data Allow: 0 Server Reuse Enable: 0 Wan Opt RTT: 65535
IP Opt MIN Allow: 0 IP Opt MAX Allow: 0 IP Opt Min Clear: 0 IP Opt Max Clear: 0 IP Opt Min Deny: 0 IP Max Deny: 0 IP Opt Min Cnt: 0 IP Opt Max Cnt: 0 TCP Opt Min Clear: 1 TCP _opt Max Clear: 255 TCP Opt Min Deny: 0 TCP Opt Max Deny: 0 Norm TTL: 0 Norm TOS: 0 Norm Class: 0 Norm Hop: 0 IP Len Min: 0 IP Len Max: 0 IP Len Min Deny: 0 IP Len Max Deny: 0 Reserve Bits: 0 IP TS Action: 0 IP Rec RT Action: 0 IP Strict RT act: 0 IP Loose RT Action: 0 IP Security: 0 IP Stream: 0 IP Dont Frag: 0 Exceed MSS: 1 Chksum V: 1 TTL Ev Pr: 0 Urg: 0 Win Var: 0 TTL Norm val: 0 Class Norm Val: 0 Hop Norm Val: 0 Max Connections: 0 Inactivity TO: 4294967295 secs Unidirectional: 0 Reassemble TO: 60 secs Conn Max: 4294967295
More interesting is to get the interface id with the command :
switch/Admin(config-pmap-c)# do show np 1 interface iflookup First burnt-in MAC: 00:30:f2:75:f3:f1 Last burnt-in MAC: 00:30:f2:75:f3:f7 No of burnt-in MACs: 7 Hostid: 2 Shared vlan macs currently in use (offset from 2048): 0-7 Vlan-vmac indexes currently in use: 0-3 Flags: Valid shared bridged ftstatus ssl-test normalization icmp-guard switch-m ode ftvlan remove-eth-pad no-of-lifs
Hi guys!I have a simple topology that consists of the one Palo alto and 2 N9K nexuses (VPC domain). In my case, the topology does not imply a SPINE (don’t ask me why? :-). It is not a production topology, only staging. ( you can fi...
Hi guys!I have a simple non-standard topology: Palo Alto, and 2 N9K in VPC domain. ( a diagram you can find in attach). I don't have SPINE in my configuration (pls don't asking me why? . It is non production topology yet, only staging. Between Nexus...
Hello, I need your help please. I have a new ACI equipment. I can see my two directly connected leaf in APIC graphic interface, but when I set the id (101) the leaf status is eternaly stuck in "Discovering". I had been researching, but I...
Folks, Last few days i am searching for this answer on google but i didn't get any satisfied answer so thought let me ask here. I am running small spine-leaf EVPN+VxLAN and i want to use arp suppression to reduce my broadcast. I have couple of V...
If you were asked to explain to a customer who wants to see the benefits of ACI and you had to explain the difference between Network and App centric how would you do this in the least amount of technical jargon included?