The unwanted IP address space is much larger than the RFC 1918 addresses you have included in your ACL. f you are really fastidious about not letting in undesirable traffic consult such sites as The Bogon Reference - Team Cymru for lists of bogons to be denied.  (It is of course not the only site but it is the easiest for me to remember) Also the easiest way to prevent inter-VLAN routing might be to put each VLAN in its own VRF and leak the global route to the global routing table.  Then you have independent control over what each VLAN is able to access. ... View more

  Thanks. Yes to the former – If I put the hostname/devicename in the project via the GUI I would like to be able to retrieve that value via a template variable.   However I would like to see your example of populating a template with items from the API. I always learn something when I look at your code.   Thanks for all your contributions to the community!   ... View more

dcloud is actually very good. You can't do everything but you can do a whole lot! ... View more

I started to do that at AWS. You basically cannot get a 64GB memory machine. I can't remember if I actually got one configured but I do remember calculating that a 6 CPU 64GB machine with 250+ disk space would run about $75/day.  That would be in addition to a machine running PRIME. So for 3 months of lab you could just spend $6K on hardware and run both APIC-EM and prime on a host (like ESXi). APIC-EM will run (not sure how well) on 40GB but as I remember the best machine I could get at AWS was 32GB Good luck and let us know what you find. ... View more

Thanks. I realize the best practice.  In my case what is done is done. The issue seems to be cosmetic as the two datacenters seem to work fine except the thousands of SYSLOG messages. I would like to block the VPC  traffic that is traversing the L2 link between the data centers. Based on the message identifier I have to assume that it is some kind of PIM multicast traffic. Also out of curiosity I would like to know what this traffic is. Peer discovery should happen over the peer link and not across every VPC VLAN. Perhaps I could solve this by blocking all PIM on the offending VLANs. Unfortunately one of the VLANs needs to transport PIM multicast. I would think that there is a known multicast address that is causing the messages and if I block that address with a  VACL the messages would cease. ... View more

Can you run your DMZ VLAN(s) through a separate Overlay interface and maintain separation that way? Each OTV overlay interface name defines a separate VPN to OTV. ... View more