Hi folks,   sorry, if this has already been answered somewhere, but I couldn't find a clear statement. Is it possible to run an APIC cluster containing both L2 and L3 APICs? If so I assume overall scalability numbers fall down to L2 values, correct?   Thank you and kind regards, Nik ... View more

Hello community,   we have the following situation (drawing attached for better understanding): One tenant, one VRF, one L3Out. Two Firewalls connect to the L3Out, one dedicated to a specific segment (FW) and a general purpose perimeter firewall (PFW). We also have a firewall implemented via an unmanaged Service Graph (SGFW) that is sort of perimeter and east-west. The L3Out has two External Networks configured, EN1 with 0.0.0.0/0 and EN2 with 1.1.1.0/24. EN1 consumes a Service Graph contract SGCon, EN2 consumes a normal contract NormCon. vzAny for the VRF provides SGCon, NormCon is only provided by a limited set of EPGs.   Our intention was that by default all traffic in and out of the fabric has to go across the SGFW via Service Graph. Inside the fabric we can use the two contracts to decide if the firewall is crossed or not. For traffic in "normal" networks that seems to work fine, however we see issues with the transfer networks configured under the L3Out (4.4.4.0 and 5.5.5.0). If we have a traffic flow from our special segment to an address outside the fabric, let's say between 1.1.1.1 and 9.9.9.9 it is steered through the SG in both direction, as expected. If we have a traffic flow from the transfer network (5.5.5.0) to the external address 9.9.9.9 it goes to the service graph only one way, i.e. 9.9.9.9 -> 5.5.5.5 goes to the SGFW, 5.5.5.5 -> 9.9.9.9 does not. This is kind of strange since both networks from an External Network point of view should be in EN1 and the only contract EN1 has is SGCon. To make it even more mysterious if we add 5.5.5.0/24 to EN2, which is supposed to use the non-SG contract NormCon, then 5.5.5.5 -> 9.9.9.9 starts going to the Service Graph.   Can anyone make sense of the traffic flows and why they behave as they do? I have two assumptions but I can't seem to get my head around them: 1. It has to do with vzAny also including the External Networks, so that we have contracts where we don't want / expect them 2. There is something special about directly connected subnets in the L3Out   Any help would be much appreciated. Thank you and kind regards, Nik ... View more

Hi community,   I have at least one major issue, perhaps even two. We have a small demo-lab, one APIC, two leaf switches, one spine. A critical fault ( F3031) is raised with a description of "Node Certificate is invalid: Failed to parse the subject line as a valid ACI fabric certificate AND Invalid Serial Number AND Invalid Product ID". The fault is raised for the APIC. For a time everything went fine, though. We had this fault but nothing really happened. Now I reset the fabric to factory defaults and started building it up from scratch. All nodes are discovered successfully, however they turn to an "inactive" state right after discovery. I have seen this happen in other environments for a short period, maybe up to a couple of minutes but in this case it's been hours now, since the devices have been discovered. I have a hunch this issue might be related to the invalid certificate. Am I on the right track or are those problems not related? What can I do to get back a valid certificate?   Thank you and kind regards, Nik ... View more

Hi community, I recall from a Cisco Live presentation that in multipod Environments every pod should have their own pair of BGP route reflectors. The same could be read between the lines from the Multipod Whitepaper (https://www.cisco.com/c/en/us/solutions/collateral/data-center-virtualization/application-centric-infrastructure/white-paper-c11-737855.html#_Toc521671384). However I don't understand, if this is a mere recommendation or a must-have configuration? What could potentially happen if I had only one RR per pod and lost it due to a failure? Would I lose connectivity to the other pods? For all traffic? Just for new sessions? Only for routed traffic?   Also: It seems like it's not possible to have a RR-policy per Pod so I assume I have to put all spines into the default policy, right? I could define several Pod Policy Groups but there seems to be no different Option than selecting "default" as the BGP RR policy.   Thank you and kind regards, Nik ... View more